FR2836768A1 - Digital signal formation having digital word generators with assistance/calculation systems producing intermediate respective result transmitting combination system/combining intermediate result. - Google Patents

Abstract

The digital signature formation system has a number of digital words generators (k1 to ki). There are a number of systems of assistance (A1 to At) and calculation of an intermediate respective result (r1 to rt) from the previous result and transmit the intermediate result to a combination system (C) combining intermediate results with a combination system.

Description

<Desc / Clms Page number 1>

 The present invention relates to a method and a device for forming a digital signature exclusively associating a digital data message with a natural or legal person, said signatory of the message, who has at least one secret key, and intended to be transmitted with said message to at least one other person, said recipient of the message, to verify the message accompanied by said signature. More specifically, the invention relates to digital signature methods of the type comprising the steps of: - making available to the signatory system a generating data, - calculating the image of said generating data by a transformation deemed non-invertible, to put said image available to the signatory system, - forming the digital signature in the signatory system from said image, said generating data, said secret key and said message.

 For the purposes of the invention, the digital signature designates both a set of data or digital codes, that is to say a bit string, specific to a pair formed by the message and the signer, and a cryptographic method for generate such a string of bits.

A digital signature exclusively associates a digital data message with the signer and is intended to be transmitted with the message to at least one recipient of the message, who must verify the signed message, ie the message accompanied by the message. signature. For the purposes of the invention, by verification of the signed message is meant a set of operations tending to verify the origin of the signed message, that is to say to verify that the message actually comes from the signatory and not from someone who tries to impersonate himself, and the integrity of the signed message, that is to say that the message content has not been changed between sending it by the signer and receiving it by the recipient.

 Within the meaning of the invention, a system designates a programmable data processing system provided with calculation means, storage means and a communication interface for exchanging data. Anyone wishing to apply a digital signature process, as a signatory and / or as a recipient

<Desc / Clms Page number 2>

verifier, must of course use such a system. Subsequently, therefore, any signatory and any recipient are identified with the systems they use, designated respectively by the signatory system and the recipient system.
A digital signature is independent of the recipient and verifiable by any recipient receiving the message accompanied by his signature, and therefore in particular by a judicial or arbitration authority. This characteristic of the digital signature, which distinguishes it in particular from simple cryptographic authentication methods, makes it possible to implement a prohibition for signatories to repudiate their signatures. In other words, the digital signature is a reliable and verifiable means of proof by third parties and thus lends itself to legal applications.

 Note that the digital signature is a separate cryptographic process independent of the encryption methods that could be used to ensure the confidentiality of the message. On the one hand, the signed message can very well be sent in clear to be readable by any recipient, on the other hand, if one wishes to encrypt the message sent, any known encryption method can be used. In addition, it is possible to encrypt a previously signed message or to sign a previously encrypted message without interference between these successive operations.

L-L - un module entier premier p vérifiant 2 < p < 2, c'est-à- dire que p est codé sur L bits, avec L compris entre 512 et 1024, L étant un multiple de 16, la taille du module p étant fixée par des considérations liées a la sécurité ; - un entier premier q divisant p-1 codé sur 160 bits, avec

2159 < q < 2160 ; - un entier g d'ordre q dans le groupe Z/pZ, c'est-à-dire que g engendre un sous-groupe de cardinal q dans Z/pZ, où Z désigne l'ensemble des entiers relatifs ; Figure 1 illustrates a standard public-key type digital signature method known as DSA (for the English Digital Signature Algorithm). The parameters of this algorithm include:

LL - an integer prime module p satisfying 2 <p <2, ie p is encoded on L bits, with L between 512 and 1024, L being a multiple of 16, the size of the module p being fixed by security considerations; a prime integer q dividing p-1 coded on 160 bits, with

2159 <q <2160; an integer g of order q in the group Z / pZ, that is to say that g generates a subgroup of cardinal q in Z / pZ, where Z denotes the set of relative integers;

<Desc / Clms Page number 3>

 an integer private key x chosen randomly such that 0 <x <q; a public key y calculated such that y = gx modulo p, that is to say that the public key is the remainder of the entire division of g'par p.

 The integers p, q, and g are public and can be shared by multiple users and used for multiple signatures. For example, they are published by a certification authority. A signatory system 1 must sign and send an M message to a recipient system 2. The signer system 1 is provided with the public key y and the private key x. The private key x is specific to the signatory system 1 and must be kept secret by the latter. It is necessary to generate the digital signature of the signatory system 1. The public key is published by the signatory system 1 to be made available to the destination system 2, as indicated by the arrow 3. The pair of keys x, y can to be used by the signatory system 1 to sign several messages.

 To sign the message M, the signatory system 1 performs the operations of: randomly generating an integer k such that 0 <k <q as the data generating the signature; - calculate the integer r = (gk modulo p) modulo q as an image of the generating data by a transformation considered non-invertible; - calculate the integer s = (kl (SHA (M) + xr)) modulo q, where SHA denotes a cryptographic hash function, the hash function defined by the FIPS 180 standard, which is made public as the integers p, q and g.

 The pair of integers (r, s) constitutes the signature 4 that the signatory system 1 annexes to the message M to form a signed message 5 that it sends to the recipient system 2. When it receives a message M'with a signature ( r ', s'), the destination system 2 can check the signed message, that is to say verify that it actually comes from the signatory system 1 and the message M is identical to the message M sent by the signatory system 1. For this, the recipient system 2 performs the operations of: - calculating the integer w = (s') "'modulo q; - calculating the integer u = (SHA (M') w) modulo q;

<Desc / Clms Page number 4>

 calculate the integer u '= (r'w) modulo q; - calculate the integer v = (g y modulo p) module q.

 - compare the integer v with the received integer.

 The result of the verification is positive if and only if v = r '. In the opposite case, the destination system 2 concludes that the message originates from another origin and / or has been modified during the transmission. For the purposes of the invention, the signature 4 is considered to associate the message M exclusively with the signatory system 1, insofar as only the signatory system 1 in possession of its private key x and the message M can form the signature 4.

 The security of this type of digital signature is based on the deemed non-invertible character of a mathematical operation, that is to say here of the discrete exponentiation operation in the Z / pZ group. For the purposes of the invention, a mathematical operation is deemed to be non-invertible when the calculation consisting of inverting it presents an extreme difficulty, taking into account the existing calculation means. In other words, it is the extreme difficulty of calculating the private key x when we know the public key y and calculate the integer k when we know the integer r. This ensures the secret character of the private key x of the signatory system 1. In fact, it is today impossible in practice to solve this problem, said discrete logarithm, for such large numbers.

 A problem with this known method lies in the operating cost of the discrete exponentiation. This cost requires the signatory system 1 to provide high power calculation means, in terms of processor and memory rate, or to provide a significant calculation time, or to make a compromise between these two requirements.

However, two additional constraints must be taken into account in this compromise. On the one hand, in many applications, particularly related to the transmission of documents of legal value, and more particularly in the context of electronic transactions, the digital signature must be generated in real time while the user is waiting, so that the calculation time must be kept within acceptable limits for the user, for example of the order of a few seconds. On the other hand, the electronic signature, insofar as it must be able to replace the handwritten signature,

<Desc / Clms Page number 5>

 must also be accessible in the exercise of daily actions, such as an electronic transaction or sending an e-mail, that a fountain pen is accessible to the signatory by hand. It is therefore desirable to make electronic signatures using portable devices such as radiotelephones, personal digital assistants and the like, whose calculation capabilities are insufficient to achieve the aforementioned discrete exponentiation in an acceptable time.

 To meet these requirements, several solutions have already been considered. It is possible to add specific computing hardware to a device of the aforementioned type to bring its computing power to a satisfactory level. This obviously increases the cost of the device. Optionally, it can also be provided that the apparatus performs in the background a calculation of preparatory data for a subsequent signature. However, the power supply of this type of device being provided generally by batteries, the performance of large preparatory calculations in the background has the disadvantage of reducing the autonomy of the device.

 Another type of solution is to modify the calculation algorithm to improve its efficiency. The document WO 99/33220 A1 proposes a variant of the aforementioned DSA algorithm making it possible to accelerate the calculations without substantially modifying the result. Although the path of algorithmic improvements is generally beneficial, its exploitation to the extreme necessarily leads to modifications depending on the architecture of the signatory system, which makes it necessary to deviate from a standardized standard algorithm. This then results in disadvantages for the implementation and maintenance of a fleet of heterogeneous devices.

 The document EP 666 669 B1 proposes another solution consisting of, on the one hand, using a variant of the DSA algorithm and, on the other hand, having the discrete exponentiation calculations carried out by a certification authority which then transmits the result to the signatory system. According to this known method, the calculation of the image of the generating data k, that is to say gk modulo p, is performed by the certification authority. For this purpose, the certification authority and the signatory system are provided with two identical pseudo-random number sequence generators and share a given data.

<Desc / Clms Page number 6>

r d'initialisation pour engendrer séparément une même séquence de données génératrices.

r initialization to separately generate a same sequence of generating data.

 This characteristic creates flaws in the safety of the method described in EP 666 669 B1. Indeed, with this method, the certification authority holds the generating data k and its image. When the signer sends a signed message, it is possible for a malicious person to obtain the signature of the message. This is particularly easy if this person is a recipient of the message or if the signed message is sent in the clear. This malicious person could be a member of the certification authority itself or, more likely, someone who would have temporarily taken control of their systems. Now the knowledge of the signature (c, s), received with the signed message, and the generating data k, fraudulently acquired from the authority, gives immediate knowledge of the private key x since x = (sk) / c, according to the notation used in this document. However, it is certain that if a third party holds the private key x of a signatory system, this third party can pretend to be the signatory without the possibility of being unmasked. This can have very serious consequences for the victim, if the victim is bound by a clause of nonrepudiation of signatures.

 In addition, the generator initialization value could be intercepted by a malicious third party during its transmission between the signing system and the authority. If the third party has the pseudo-random generator, he will be able to determine, not only the data that generates a particular signature, but also a whole series of subsequent signatures, which increases his chances of obtaining the private key x of the system. signatory.

 In fact, the method described in EP 666 669 BI presents risks equivalent to those that would entail a total delegation of signature operations by the signatory system to the certification authority. Such delegation is acceptable only if absolute confidence can be placed in authority. In practice, the risks of identity theft are such that it is unlikely that a signature generated entirely by a third party system on behalf of a signatory has any legal value.

<Desc / Clms Page number 7>

 The invention aims to provide a method and a digital signature device remedying at least some of the aforementioned drawbacks. In particular, the invention aims to provide a more secure signature method, compatible with standard signature algorithms, and usable with a signatory system with limited computing capabilities.

 For this, the invention proposes a digital signature method of the aforementioned type, characterized in that the generating data is made available to the signatory system exclusively in the form of a plurality of antecedents of the generating data. associated with the generating data by a known association function of the signatory system, the image calculation comprising the steps of: - providing each of a plurality of assistance systems with a respective one of said antecedents, - calculating a respective intermediate result using each of said assistance systems from the antecedent available to it, - transmitting said intermediate results from said assistance systems to a combination system, - combining said results intermediates using said combination system to calculate said image.

réputée non inversible, soit T (k). L'invention est fondée sur l'idée e ee d'obtenir depuis l'extérieur du système signataire l'image de la donnée génératrice ou un résultat proche, c'est-à-dire un résultat de calcul permettant d'atteindre cette image en un petit nombre d'opérations réalisables par le système signataire, et ce, sans avoir à communiquer la donnée génératrice à l'extérieur du système signataire. The invention applies to digital signatures requiring a pair of data generating the signature, ie k, and the image of this generating data by a mathematical transformation.

deemed non-invertible, that is T (k). The invention is based on the idea of obtaining from the outside of the signatory system the image of the generating data or a close result, that is to say a calculation result making it possible to reach this image in a small number of operations achievable by the signatory system, without having to communicate the generating data outside the signatory system.

This idea is implemented by exhibiting an association function F associating the generating data k with a tuple of antecedents, ie kl, k2, ... kt, t being an integer greater than or equal to 2. For example , the association function F checks the relation:

<Desc / Clms Page number 8>

The assistance systems calculate intermediate results from the antecedents, for example by applying an intermediate transformation Hi (ki) to the corresponding antecedent ki, and these intermediate results, ri, r2, ... rt, are combined by the combining system so as to obtain the image of the generating data or the close result, for example using a combination function K (ri, r2, ... rt).

In this method, the expensive mathematical operations related to the calculation of the image of the generating data, for example by discrete exponentiation, are extemalized with the assistance systems, which are, for example, fixed terminals designed to perform the intermediate calculation which is devolved in an acceptable time, for example in a few milliseconds. This results in a calculation time of the acceptable signature without providing the signatory system with specific calculation equipment. It also results that the formation of a digital signature is low energy consuming for the signatory system and does not significantly affect its autonomy
In addition, the generating data is not made available to another system that the signatory data processing system, that is to say, it is kept strictly private. This avoids any system other than the signatory system being able to generate the authentic signature of the signatory system. As a result, it is not necessary to have absolute confidence in the assistance systems, which each know only one antecedent of the generating data and should therefore cooperate with each other to obtain the generating data, neither have absolute confidence in the combination system, which does not know the generating data or its antecedents.

 In addition, the antecedents and the law of association can be chosen to make the calculation operation of the generating data impossible in the absence of any one of said antecedents. Thus, the theft of the generating data will only be possible by taking control of all the assistance systems. The number of assistance systems is any number greater than or equal to two, for example, 2.3, 10 or more. It can be increased to reduce the probability of theft of the generating data.

<Desc / Clms Page number 9>

 According to a particular characteristic of the invention, the combination system is included in the signatory system. In this case, the signatory system can receive the intermediate results and combine them into a limited number of operations to form the digital signature.

 According to another particular characteristic of the invention, the combination system is separate from the signatory system, and the method comprises the step of transmitting the result of the combination of the intermediate results from the combination system to the signatory system. In this case, the number of operations to be performed by the signatory system can be further reduced.

 According to yet another particular characteristic of the invention, the combination system is included in one of said assistance systems. Thus, at least one embodiment of the invention can be provided with two data processing systems in addition to the signatory system, namely two assistance systems, one of which is also a combination system. Of course, more support systems can also be used for greater security.

 According to a particular embodiment of the invention, said antecedents and said generating data are calculated by the signatory system using the association function, the signatory system making available to each of the assistance systems a respective antecedent by transmission. on a respective secure transmission channel.

For example, the generating data is the sum of the antecedents.

 According to another particular embodiment of the invention, each of the assistance systems generates a respective antecedent and makes it available to the signatory system by transmission on a respective secure transmission channel in response to a request from the signatory system, the signing system calculating said generating data using said antecedents and the association function.

 These secure transmission channels can be obtained by any known encryption method. Credit card payment systems provide examples well known to those skilled in the art. Preferably, each of the transmission channels is secured using a secret symmetric key, which is used both for encryption and for encryption.

<Desc / Clms Page number 10>

e Il est possible que le système signataire garde un des antécédents pour calculer lui-même un résultat intermédiaire à partir de cet antécédent, du moins lorsqu'un tel calcul n'est pas trop coûteux. Selon une alternative avantageuse, tous les antécédents sont mis à disposition des systèmes d'assistance, de manière à minimiser la charge de calcul pesant sur le système signataire. decryption by the signatory system and by the corresponding assistant system.

It is possible that the signatory system retains one of the antecedents to calculate itself an intermediate result from this antecedent, at least when such a calculation is not too expensive. According to an advantageous alternative, all the antecedents are made available to the assistance systems, so as to minimize the computational burden on the signatory system.

 The invention is aimed in particular at the case where there exists a deemed non-invertible transformation T used to calculate the digital signature, an association function F computable by the signatory system, identical or distinct intermediate transformations Hi, computable by the control systems. respective assistance to obtain the intermediate results and a combination function K computable by the combination system, which check for any t-tuple of antecedents ki, k2, ... kt a relation of the type: K [Hl (kl), ..., H, (kt)] = T [F (ki, ..., kJ].

 According to a particular embodiment, the generating data defines an integer k greater than 1 and the transformation deemed non-invertible comprises a calculation of the result of k compositions of a neutral or other element with an element g of a group G by a distribution law. internal composition of this group, each of said antecedents defining an integer ki such that the sum of the integers ki is equal to the integer k, each of said intermediate results comprising the result of ki compositions, for example said neutral element, with said element g of the group G by said composition law, the combination system combining said intermediate results by applying said composition law to the respective results of the compositions. For example, the antecedents are equal to the integers ki or the antecedents define the integers ki via a predetermined mathematical transformation.

 The calculation of the result of the compositions of the neutral element with the element g may comprise successive operations of composition with the element g or, preferably, comprise operations of composing the results of the preceding composition operations with each other, way to achieve the result in less than

<Desc / Clms Page number 11>

 composition operations. For example, for ki = 4, the computation of g4 results from the computation of g2 = g * g (first operation) then from the computation of g4 = g2 * g2 (second operation); rather than the three successive operations: calculating g2 (first operation), calculating g3 = g2 * g (second operation), calculating g4 = g3 * g (third operation).

 Thus, the method is compatible with the digital signature algorithms in which the image of a generating data is calculated by successive compositions by a composition law in a group, for example in accordance with the DSS and ECDSS standards and the algorithmic variants based on on these. The method according to the invention thus makes it possible to cumulate the efficiency and speed gains related to algorithmic improvements, both at the level of the signatory system and of the assistance systems, with the speed gain related to the extemalisation of expensive calculations. with assistance systems.

 The group G is a group in which the discrete exponentiation is considered non-invertible, for example of the Z / pZ type, where p is an entire prime module or not, with a multiplicative law. For example, p can be prime or the product of two prime numbers.

According to another possibility, the group G can be defined by a law of multiplication by an integer on an elliptic curve, the law of composition of the group then being noted as an addition.

 Advantageously, the element g and the composition law are made available to the recipient entity (s) to enable verification of the signed message.

 Advantageously, each of said antecedents defines an integer ki between 0 and a predetermined upper bound, said upper bound being preferably of the order of 2160 or greater, for example of the order of 2200. The value of the upper bound is resulting from a compromise. It is chosen large enough to prevent any possibility of exhaustive attack, but as small as possible to limit the computational cost of the digital signature process.

 Ideally, the upper bound is equal to the cardinal of the group G divided by the number of assistance systems. Thus, the sum of the integers ki is less than this cardinal and no

<Desc / Clms Page number 12>

 Modular reduction is necessary at the time of summation of integers ki. In practice, for reasons of efficiency, it is possible to choose the lower upper bound to the group G cardinal divided by the number of assistance systems if it is desired to avoid a modular reduction, or equal to the cardinal group G divided by the number of assistance systems if we do not tolerate any loss of entropy.

 Thanks to this characteristic, the knowledge by a malicious third party of some of the antecedents, for example acquired fraudulently from the assistance systems, does not decisively facilitate access to the generating data. Indeed, if we suppose that a third party knows all the antecedents except one, and therefore all the numbers ki except one, his only possibility to determine the generating data is to try all the possible values for the missing number, c i.e., all integers between 0 and the predetermined bound. In other words, the probability for this third party to access the generating data remains very small. When using the DSA algorithm, the upper bound is the integer q. In this case, the generating data is also between 0 and the predetermined terminal. As a result, in this case, knowledge of all but one of the antecedents leaves access to the generating data as difficult for a malicious third party as ignoring all antecedents.

 Preferably, the intermediate result calculated by each of the assistance systems results from the application of an intermediate transformation deemed non-invertible to the antecedent made available to said assistance system.

 Advantageously, the signature comprises a first signature element calculated by applying to said generating data a transformation dependent on the secret key belonging to the signatory system and the message to be signed, and a second signature element depending on said image, said first signature element. being intended to calculate a verification parameter in a manner known by said recipient entity (s), said second signature element being intended to provide a reference element to be compared by said entity (s) recipient (s) with said verification parameter to verify the signed message. For example,

<Desc / Clms Page number 13>

l'élément de référence est égal au deuxième élément de signature ou résulte d'un calcul à partir du deuxième élément de signature. a em e e
De préférence, le deuxième élément de signature ne dépend pas de données secrètes du système signataire. Ainsi, le calcul du deuxième élément de signature peut être entièrement effectué par les systèmes d'assistance et de combinaison.

the reference element is equal to the second signature element or results from a calculation from the second signature element. em ae
Preferably, the second signature element does not depend on secret data of the signatory system. Thus, the calculation of the second signature element can be entirely performed by the assistance and combination systems.

 The invention also proposes a device for implementing the aforementioned method, characterized in that it comprises a signatory data processing system, a plurality of assistance data processing systems separate from said signatory system, a system a combination data processing system separate from or part of said system that is a signatory and separate from, or part of, said assistance systems, and one or more data transmission networks connecting, on the one hand, said systems of assistance to said system signatory and said combination system and, on the other hand, said combination system to said signatory system when they are separated.

 Advantageously, the signatory system is integrated with a portable radiotelephone or a smart card.

 The invention will be better understood, and other objects, details, characteristics and advantages thereof will appear more clearly in the course of the following description of several particular embodiments of the invention, given solely for illustrative and non-limiting purposes. with reference to the accompanying drawing. In this drawing: FIG. 1 is a block diagram of a digital signature method of the prior art; FIG. 2 is a functional representation of a device for implementing a digital signature method; according to the invention, FIG. 3 represents the data exchanges within the device of FIG. 2; FIG. 4 is a block diagram representing two distinct embodiments of the digital signature method implemented by the device of FIG. figure 2.

 Referring to Figure 2, there is shown the signatory system in the form of a portable radiotelephone 10. The

<Desc / Clms Page number 14>

 radiotelephone 10 is provided with calculation means too limited to form a digital signature according to the DSA method described in the introduction.

To generate a digital signature in order to transmit a signed message to a correspondent, the radiotelephone 10 is programmed to cooperate with a plurality of assistance systems A 1, A 2,..., Where t is an integer security parameter greater than or equal to to 2, and a combination system C. These systems are computer servers capable of communicating with each other via a telecommunications network R, for example a wired network, whose topology can be arbitrary. The network R is provided with an addressing protocol, for example the Internet Protocol (IP). The radiotelephone 10 can exchange data over the air with a transmitting / receiving station 11, which is connected to the network R to allow data exchange between the radiotelephone 10, the assistance systems A 1, A 2,. and the combination system C.

 The radiotelephone 10 is provided with calculation means and cryptographic means for exchanging data on a respective secure channel with each of the assistance systems AI, A2,..., And the combination system C. For example, these secure channels are obtained by a symmetric key algorithm, as the algorithm known as AES, and ensure the confidentiality and integrity of the data exchanged. It then requires a separate key for each secure channel, this key is used to encrypt and decrypt the data exchanged on the channel and to be owned by the systems at both ends of the channel. The symmetric keys are for example provided by the operator of the telephone network used by the radiotelephone 10 and stored in a smart card, SIM card type, radiotelephone 10. It should be noted that such secure channels are independent of the topology of the network R and exclude that the data exchanged on each channel pass through intermediate transmission systems such as routers.

 Alternatively, the secure channels could be obtained by other algorithms. However, the calculation of a key pair according to the El Gamal or RSA type of methods is generally beyond the capabilities of the radiotelephone 10, so that one must use more summary encryption methods in practice.

<Desc / Clms Page number 15>

 With reference to FIGS. 3 and 4, the operation of the system of FIG. 2 is now described when the signatory system, that is to say the radiotelephone 10 in the example represented, must sign and send a message M to a system recipient 20, for example another radiotelephone connected to the network R.

 It is assumed that the public data of the DSA method described in the introduction, i.e., the integers p, q and g and the hash function SHA, are made available on the network R to be accessible to any user of the process. signature. The integer L is chosen equal to 1024. For example, this data is provided by a certification authority on simple request. The signatory system 10 has a private key x such that 0 <x <q, which it keeps strictly secret, and a public key calculated there such that y = g modulo p.

 A first embodiment of a signature method is described with reference to the left-hand branch of FIG. 4.

 In step 11, the signatory system 10 receives a training instruction for a digital signature, for example entered by the user using the keyboard 12. It initializes the digital signature procedure until a step is reached. which a generating data k is necessary to continue.

fonction d'association consistant à sommer les antécédents ki : k= : ki (i=1 à t)] modulo q. In step 13, the signatory system 10 generates a random sequence of t integers ki, with i = 1 to t. The numbers ki are antecedents of the generating data which verify O <ki <q. The signatory system 10 then calculates the generating data k by the

association function consisting of summing the antecedents ki: k =: ki (i = 1 to t)] modulo q.

In step 14, the signatory system 10 sends the antecedents kj, with i = 1 to t, to the respective assistance systems Al to At. Each antecedent ki constitutes or is included in a support request transmitted by the signatory system 10 to the assistance systems Al to At.

 In step 15, each assistance system A1, with i = 1 to t, calculates an intermediate result ri from the antecedent ki that it has received by applying to it an intermediate transformation defined by: = (gki modulo p) modulo q.

<Desc / Clms Page number 16>

r A l'étape 16, chaque système d'assistance Ai, avec i=l à t, envoie le résultat intermédiaire ri qu'il a calculé au système de combinaison C.

In step 16, each assistance system A1, with i = 1 to t, sends the intermediate result ri it has calculated to the combination system C.

 In step 17, the combination system C combines all the intermediate results ri, with i = 1 to t, into a final result r using the combination function of making the product of the intermediate results ri: r == [nri (i = 1 to t) modulo p] modulo q.

 In step 18, the combination system C sends the final result r to the signatory system 10, as indicated by the arrow r in solid line. The result r is the image of the generating data k by a discrete exponentiation and satisfies: r = (gk modulo p) modulo q. Since this transformation is considered non-invertible, it is not necessary to transmit the final result r in a secure manner.

 In step 19, the signatory system 10 calculates a first signature element: s = (k-1 (SHA (M) + xr)) modulo q, where SHA denotes the cryptographic hash function defined by the FIPS 180 standard. This calculation is made quickly by the signatory system 10 because it comprises a small number of operations in comparison with the calculation of r.

 Then the signatory system 10 terminates the digital signature procedure by appending to the message M the digital signature formed of the first signature element s and the result r, which it has received from the combination system C, as the second signature element. .

 In step 21, the signatory system 10 transmits the message M and its digital signature (r, s) to the destination system 20 via the transmitting / receiving station 11 and the network R. Of course, it does not It is not necessary that the sending of the message M and the digital signature be simultaneous. It is simply necessary that the recipient system has received the message and the signature, simultaneously or in any successive order, when performing the verification.

 In step 22, the recipient system 20 verifies the signed message that it has received by performing the operations of: - calculating the integer w = (sr1 modulo q - calculating the integer u = (SHA (M) w) modulo q;

<Desc / Clms Page number 17>

 - calculate the integer u '= (rw) modulo q; - calculate the integer v = (gu y modul0 p) modulo q.

 - compare the integer v with the integer r received.

 The result of the verification is positive if and only if v = r. In this case, the recipient system 20 knows for sure that the message originates from the signatory system 10 and has reached it without modification during the transmission. This certain knowledge can moreover be acquired by a third party having the signed message by performing the aforementioned verification operations himself.

 The public key y of the signatory system 10 is preferably certified by a certification authority having a server connected to the network R. It is then sent by the signatory system 10 to the recipient system 20 in the form of a digital certificate accompanying the signed message. . Such a certificate is known to those skilled in the art and allows the recipient system 20 to verify the authenticity of the public key y. For example, the certificate is formed by the certification authority concatenating the public key y and data discriminant identifying the signatory system (signatory name, address, etc.). Any recipient system must of course know the public key of the signatory system. the certification authority to read the digital certificate.

Currently, the public key of the CA is published in a directory accessible to any user.

 In the absence of such certification, in the case where the result of the verification of the signature carried out by the recipient system 20 is negative, the recipient system 20 can not ensure that this negative result does not result from an erroneous value of the public key used to perform the verification.

 In the first embodiment, the provision of the generating data k to the signatory system 10 results from the prior generation of the antecedents ki by the signatory system 10, and then from the association of the antecedents according to a summation function in Z / qZ to obtain the generating data k. Conversely, the signatory system 10 could start by randomly generating the generating data k, then calculating a tuple of antecedents ki with 0 <ki <q, for i = 1 to t, by a function of inverse association of the function of summation. For example, such an inverse function consists in generating

<Desc / Clms Page number 18>

 randomly the antecedents ki for i = 1 to t-1 and then calculate the antecedent kt such that: kt = [k- (i = 1 to t-1) I module q.

 A second embodiment of the signature method is now described with reference to the right-hand branch of FIG. 4.

 In step 23, the signatory system 10 receives a training instruction for a digital signature, for example entered by the user using the keyboard 12. It initializes the digital signature procedure.

 In step 24, the signatory system 10 sends an assistance request to each of the assistance systems Ai, with i = 1 to t.

 In step 25, each assistance system A1, with i = 1 to t, generates an antecedent of the generating data in the form of a random integer ki satisfying O <ki <q, with it 1 to t.

 In step 26, each assistance system Ai, with i = 1 to t, calculates from the antecedent ki that it has generated the intermediate result: ri = (gki modulo p) modulo q.

 In step 27, each assistance system A1, with i = 1 to t, sends the antecedent k i that it generated to the signatory system 10, as indicated by the dashed arrows of FIG. 3.

 In step 28, the signatory system 10 calculates the generating data k by the association function: k ==: ki (i = 1 to t)] modulo q.

 In step 29, each assistance system A1, with i = 1 to t, sends the intermediate result ri that it has calculated to the combination system C.

 In step 30, the combination system C combines all the intermediate results ri, with i = 1 to t, by calculating the product: r = [ri (i = 1 to t) modulo p] modulo q.

 In step 31, the combination system C sends the final result r to the signatory system 10.

 The process then continues from step 19 as in the previous embodiment.

 In the two aforementioned embodiments, the signature method begins with the express instructions of the user, in step 11 or 23. Alternatively, it can be provided that the steps preparatory to the formation of the signature itself, is to say

<Desc / Clms Page number 19>

 the steps preceding step 19, are performed in advance, for example in the background, so that it remains only to perform steps 19 and following when a digital signature is requested. This results in further reduction of the response time of the signatory system. Moreover, the quantity of operations involved in the preparatory steps is small enough not to saturate the processor of the signatory system 10 durably.

 In Figure 3, there is also shown an alternative embodiment of the aforementioned step 19. In the context of this variant, the combination system C also sends the result r, which is equal to the second signature element, directly to the destination system 20, as indicated by the dotted arrow r. In the context of this variant, the signatory system 10 only has to send the message M and the first signature element s and not the second element r. This achieves a certain bandwidth saving of the signatory system 10 when sending the signed message. However, the signatory system 10 must first communicate to the combination system C the address of the destination system 20.

 In an alternative embodiment, the combination system C may be one of the assistance systems, for example Ai or a part thereof. This variant saves a computer.

 In another alternative embodiment, the combination system C may be the signatory system 10 itself or a part thereof. Indeed, the operation of combining the intermediate results ri, corresponding to the above-mentioned steps 17 and 30, implies (t-1) integer multiplications coded on q bits. Such a multiplication is about 1500 times less expensive than a discrete exponentiation such as that carried out by the assistance systems. Thus, even if provision is made in the context of this variant that the combination operation is the responsibility of the signatory system 10, the total amount of calculations to be performed by the signatory system 10 remains approximately 1500 times less expensive. only if the signatory system were to form the digital signature without the assistance of A support systems; (he has).

 In yet another embodiment, which can be combined with the previous ones, the signatory system 10 generates a

<Desc / Clms Page number 20>

 additional antecedent kt + 1 in the form of an integer coded on a few bits, for example on 4 bits, and does not communicate it to any assistance system. In the context of this variant, in the above-mentioned step 13 or 28, the signatory system 10 calculates the generating data k by the association function: k = [Eki (i = 1 to t + 1)] modulo q. Then, in step 19, the signatory system 10 calculates a signature element r'by multiplying kt + l times by g the result r of the combination of the intermediate results to obtain a digital signature (r ', s') such that : r '= (gk modulo p) modulo q s' = (kl (SHA (M) + xr')) modulo q.

 This variant makes it possible to further reinforce the secret nature of the data generating k, since the antecedent kt + 1 is not communicated to any assistance system and can not therefore be acquired by a third party, even by taking control of the data systems. 'assistance. However, the protection conferred by the additional kit + antecedent, is limited insofar as this antecedent must be chosen much smaller size than the other antecedents ki (i = 1 to t), otherwise the computational burden imposed on the system signatory 10 would become excessive.

 Although reference has been made only to the hash function of the DSA standard in the foregoing, any other hash function can also be used as a SHA hash function as soon as one goes out of this standard.

 The above embodiments have been described with a radiotelephone for signatory system. However, the signatory system is not limited to a radiotelephone and may also be any other data processing system, in particular a system having too little computing power to autonomously compute a reliable digital signature in an acceptable time, by example a smart card.

The signatory system must be provided with storage means able to store the private key x in a secure manner.

 The various embodiments of methods described can be implemented automatically by a corresponding programming of the signatory system, assistance systems and the combination system. The realization of such programming is within the skill of the skilled person.

<Desc / Clms Page number 21>

 Although the invention has been described in connection with several particular embodiments, it is obvious that it is not limited thereto and that it comprises all the technical equivalents of the means described and their combinations if they are within the scope of the invention.

Claims (17)

A method for forming a digital signature exclusively associating a digital data message (M) with a signatory system (10) having at least one secret key (x) and to be transmitted with said message to at least one destination system (20) said message having to verify the origin and the integrity of said message accompanied by said signature, said method comprising the steps of: - making available to said signatory system a generating data, - calculating the image (r) of said generating data by a transformation

 deemed to be non-invertible, to make said image available to said signatory system, - forming said digital signature (r, s) in said signatory system from said image, said generating data, said secret key and said message, characterized by the fact that said generating data is provided (13,27) of said signatory system exclusively in the form of a plurality of antecedents of said generating data (ki-kt) associated with said generating data by a function of known association of said signatory system, said image calculation comprising the steps of: - providing (14,25) each of a plurality of assistance systems (Ai-At) a respective one of said antecedents (ki -kt), - calculating (15,26) a respective intermediate result (ri-rt) using each of said assistance systems from the antecedent placed at its disposal, - transmitting (16,29) said r intermediate results from said assistance systems to a combination system (C), - combining said intermediate results by means of said combination system to calculate said image.  2. Method according to claim 1, characterized in that said combination system is included in said signatory system.  3. Method according to claim 1, characterized in that said combination system is separate from said signatory system, said method comprising the step of: <Desc / Clms Page number 23>  transmitting (18, 31) from said combination system to said signatory system the result of combining said intermediate results (r).  4. Method according to claim 3, characterized in that said combination system is included in one of said assistance systems (A1).  5. Method according to one of claims 1 to 4, characterized in that said antecedents and said generating data are calculated by said signatory system with the aid of said association function, said signatory system making available each of said assistance systems respective antecedent by transmission (14) on a respective secure transmission channel.  6. Method according to one of claims 1 to 4, characterized in that each of said assistance systems generates (25) a respective antecedent and makes it available to said signatory system by transmission (27) on a secure transmission channel respective in response to a request of said signatory system, said signatory system calculating (28) said generating data using said antecedents and said association function.  7. Method according to claim 5 or 6, characterized in that each of said transmission channels is secured with a secret symmetric key.  8. Method according to one of claims 1 to 7, characterized in that said generating data defines an integer k greater than 1, said transformation deemed non-invertible comprising a calculation of the result of k compositions with a g element of a group G by a law of internal composition of this group, each

 said antecedents (kj-kj defining an integer kj such that the sum of the integers k, is equal to the integer k, each of said intermediate results (rj-rt) comprising the result of k, compositions with said element g of the group G by said composition law, the combination system combining said intermediate results by applying said composition law to the respective results of the compositions.  9. Method according to claim 8, characterized in that the element g and said composition law are made available to <Desc / Clms Page number 24>  said recipient entity (s) (20) to enable verification of the signed message. er i e.

 10. The method of claim 8 or 9, characterized in that each of said antecedents (k1 - kt) defines an integer ki between 0 and a predetermined upper bound, said upper bound being preferably of the order of i60 or higher.  11. Method according to one of claims 1 to 10, characterized in that the intermediate result calculated by each of the assistance systems results from the application of an intermediate transformation deemed non-invertible to the antecedent made available said assistance systems.  12. Method according to one of claims 1 to 11, characterized in that said signature comprises a first signature element (s) calculated by applying to said generating data a transformation dependent on the secret key of said signatory system and the message to sign, and a second signature element (r) depending on said image, said first signature element being intended to calculate a verification parameter in a manner known by said recipient entity (s), said second element with the signature being intended to provide a reference element to be compared by said recipient entity (s) with said verification parameter to verify the signed message.  13. The method of claim 12, characterized in that the second signature element (r) does not depend on secret data of said signatory system.  14. The method of claim 12 or 13, characterized in that said reference element is equal to the second signature element (r).  15. Device for implementing the method according to one of claims 1 to 14, characterized in that it comprises a signatory data processing system (10), a plurality of data processing systems assistance (Al-At) separated from said signatory system, a combination data processing system (C) separate or part of said signatory system and separated or part of said assistance systems, and one or more transmission network (s). data (R) connecting, on the one hand, said systems <Desc / Clms Page number 25>  assistance to said signatory system and said combination system and, secondly, said combination system to said signatory system when they are separated.  16. Device according to claim 15, characterized in that said signatory system is integrated with a portable radiotelephone (10).  17. Device according to claim 15 or 16, characterized in that said signatory system is integrated in a smart card.