JP2011199325A - Key exchange device based on identifier - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide key exchange devices whereby two key exchange devices communicate with each other to share the identical keys, and can authenticate each other based on an identifier of a communicating opposite-side device.SOLUTION: In these key exchange devices based on the identifier, a key exchange device 200 stores a message including a system parameter 201, a system public key 202, a self-identifier 203, and a self secret key 204 in a long-period storage device 205 when the message is input, takes in a random number 208 to generate a provisional key 210 when a key exchange start instruction 206 and the opposite-side identifier 207 are input, generates a provisional identifier 212 using the provisional key, stores data including the provisional key, the provisional identifier, and the opposite-side identifier in an internal state device 213, and transmits the data including the provisional identifier to a key exchange device having the opposite-side identifier, and thereby the two key exchange devices are allowed to mutually authenticate the communicating opposite-side device on the basis of the identifier of the opposite side.

Description

  This invention is a system in which two key exchange devices communicate with each other and share the same key, and both devices can authenticate each other's device with which they communicate with each other based on the other's identifier, The present invention relates to an authenticated key exchange apparatus.

  In the key exchange method, there is a method in which two devices participate and the two devices communicate with each other to share the same key. In particular, a method in which each device is provided with a means for authenticating that it is its own device, and the method for authenticating the partner device with which the key has been exchanged by this means is called an authenticated key exchange method.

  FIG. 5 shows a configuration of a non-recognizable authenticated key exchange system described in Non-Patent Document 1 as an example of a conventional authenticated key exchange system. The outline of a conventional key exchange method with authentication will be described below with reference to FIG. The following description summarizes the contents of Non-Patent Document 1 described above.

As shown in FIG. 5, two devices 500 that perform key exchange have a private key 501 of the own device, a public key 503 of the counterpart device, a key exchange device A 507 to which a random number 513 is input, and a private key 504 of the own device. It consists of a public key 502 of the counterpart device and a key exchange device B508 to which a random number 514 is input.
Here, the private key 501 of the own device inputted to the key exchange device A507 is called skA, the public key 503 of the counterpart device B508 is called spkB, and the random number 513 is called rA, and the private key of the own device inputted to the key exchange device B508 It is assumed that 504 is called skB, the public key 502 of the counterpart apparatus A 507 is called spkA, and the random number 514 is called rB.

The key exchange device A 507 and the key exchange device B 508 incorporate a public key cryptosystem encryption device and a decryption device, and the above-described keys skA, spkB and the like are the public key cryptosystems to which the two key exchange devices 500 correspond. Private key and public key used in
In addition, the key exchange device A 507 and the key exchange device B 508 each include an authentication device and a pseudo-random number generator.

Let p be a prime number and g be a generator of a subgroup of prime order q of (Z / pZ) ^* . Here, p and q are assumed to be sufficiently large.
In the device 500, it is assumed that the key exchange device A507 first starts communication, but this assumption does not deny the generality.

The key exchange apparatus A507 randomly selects x∈Z / qZ and the authentication apparatus key kA. Key exchange apparatus A507 includes a hA = g ^x, and generates the cA as ciphertext Public Key pkB key kA of the authentication device, as indicated by 515 in FIG. 5, and transmits to the key exchange apparatus B 508.

The key exchange apparatus B508 randomly selects yεZ / qZ and the authentication apparatus key kB. The key exchange apparatus B 508 generates cB as ciphertext with hB = g ^y and the public key pkA of the authentication apparatus key kB.
Next, it is assumed that the ciphertext cA is decrypted using the public key pkB and kA 'is obtained as a result.
Next, an authentication code tB for hA and hB is generated using kA ′.
Finally, as indicated by 516 in FIG. 5, the key exchange device B508 transmits hB, cB, tB to the key exchange device A507.

  The key exchange device A507 verifies the authentication code tB for hA and hB using the key kA of the authentication device. If the verification result is not correct, the operation is stopped here.

In other cases, the ciphertext cB is decrypted using the key kA of the authentication device, and the result is kB ′.
Next, an authentication code tA for hA and hB is generated using kB ′.
Next, a pseudorandom number qA is generated from the hB ^X by a pseudorandom number generator using kA as the key of the authentication device.
Next, a pseudorandom number qB ′ is generated from the hB ^X by the pseudorandom number generator using kB ′ as the key of the authentication device.

The key 510 which is the exchange result is output as an exclusive OR for each bit of the pseudo random number qA and the pseudo random number qB ′.
Finally, the authentication code tA is transmitted from the key exchange device A507 to the key exchange device B508 as indicated by 517.

  The key exchange device B508 verifies the authentication code tA for hA and hB using the key kB of the authentication device. If the verification result is not correct, the operation is stopped here.

Next, a pseudorandom number qA ′ is generated from the hA ^y by the pseudorandom number generator using kA ^′ as the key of the authentication device.
Next, the hA ^y, using kB as a key of the authentication device to generate a pseudo-random number qB by the pseudorandom number generator.
Finally, the exchange result key 511 is output as a bitwise exclusive OR of the pseudorandom number qA ′ and the pseudorandom number qB.

  The key exchange device A507 may output the knowledge obtained as a result of communication with the key exchange device B508 as a history 509.

  On the other hand, in the first key exchange, all parameters necessary for the Diffie-Hellman key exchange method are generated and public information sharing processing is performed, and then the key exchange processing is performed. In the subsequent key exchange, the secret information already shared is used as one of the public information in the new key exchange, and the key exchange process is performed without generating and sharing the parameters. . Since it is not necessary to generate part of the public information to be shared during the second and subsequent key exchange processes, the process of generating an arbitrary number in the key exchange process can be omitted, and the number of parameters to be notified is reduced. The size of the packet containing the public information to be reduced is reduced, which in turn can reduce the amount of communication, and the secret communication using the common key cryptosystem that can eliminate the need to transmit the public information to the communication path. A common key exchange method is known that provides an efficient and secure key exchange method with a small amount of communication (see Patent Document 1).

  According to the technique described in Patent Document 1, it is described that the amount of communication required at the time of key exchange processing can be reduced ([0057]).

  The digital TV device and the HDD recorder are DTCP-IP compatible devices, and transmit and receive copyright-protected content via the IP network. When the digital TV apparatus starts an authentication key exchange process with the HDD recorder, the digital TV apparatus sets the TTL value of the TCP packet to be transmitted first for the authentication key exchange process to an allowable number in DTCP-IP. If there is no response to the packet, a message is displayed to warn of a malfunction in the IP network configuration. On the other hand, the HDD recorder measures the RTT value with the digital TV device during the authentication key exchange process, and if the measured value exceeds the allowable value in DTCP-IP, the performance problem of the IP network A communication device, a digital television device, and a notification method for a communication device that realizes appropriate notification to a user by displaying a message that warns the user is known (see Patent Document 2).

  According to the technique described in Patent Document 2, it is described that an authentication key exchange process for transmitting and receiving an authentication key for authenticating each other can be performed ([0008]).

Also, at least a secret key x (where x is an integer from 0 to p-1) and public keys g1, g2, w, u, v (where w = g2 ^x , u and v are elements of G ₂ ) are generated. The document m is acquired. Next, random numbers r and s are generated,
σ = {g1 ^m φ (u) φ (v) ^s } ^{1 / (x + r)}
And the signature (σ, r, s) and the document m are transmitted to the signature verification apparatus. The signature verification apparatus receives the signature (σ, r, s) and the document m, and acquires the public keys g1, g2, w, u, v of the signature generation apparatus. next,
e (σ, wg2 ^r ) = e (g1, g2 ^m uv ^s )
If it is true, the signature is valid, and if it is false, the signature is invalid. A digital signature method, a digital signature generation method, a digital signature verification method, a system, an apparatus, a program, and a recording medium using these methods are known that provide a signature scheme that can be used for blind signatures, etc. (Patent Literature) 3).

  According to the technique described in Patent Document 3, it is described that a group operation of a bilinear map can be efficiently calculated ([0009], [0010]).

  In addition, the server includes a server that manages a dynamically changing network address and a fully qualified domain name in association with each other, and a plurality of network terminals that perform encrypted communication with each other, and each network terminal has its own network address. Register with the server, query the DDNS server for the destination network address for encrypted communication, and if the destination network address cannot be obtained, enter the key exchange wait state and get the destination network address When two network terminals do not know which one will connect to the network first, by dynamically starting the key exchange communication to the other party, or by giving a notification prior to the key exchange communication, the IP address changes dynamically Network system and key exchange method to ensure that key exchange is possible It is known (see Patent Document 4).

  According to the technique described in Patent Document 4, two network terminals that perform key exchange can reliably exchange key information between two terminals even in an environment where the network address dynamically changes. ([0011]).

  Also, one embodiment of the method and / or system in which a secret key in a cryptographic system can be replaced without revealing the secret key is to create a first public key corresponding to the first private key. It has. A second private key associated with the first private key and a second public key corresponding to the second private key are also created. The second private key is output once so that it can be re-created, and the second public key is output when outputting the first public key. The first private key is used for authentication. The method further comprises re-creating a second private key and using the second private key for authentication. Another embodiment includes creating a private key and a corresponding public key with associated system parameters, outputting system parameters when outputting the public key, and authenticating the private key. It is used for. The method further comprises creating a new private key utilizing the previous private key and system parameters. Such a system, apparatus, and method for exchanging encryption keys are known (see Patent Document 5).

According to the technique described in Patent Document 5, as a method for authentication in a public encryption system, it is described that a private key and a corresponding public key are created using related system parameters ([0011]).
Mario Di Raimond, Rosario Gennaro, Hugo Krawczyk: Deniable Authentication and Key Exachange.13-th ACM Conference on Computear and Communication Security. JP 2000-278258 A JP 2007-069705 A JP 2007-088906 A JP 2007-208683 A JP-T-2006-513641

  The first problem in the conventional authenticated key exchange method described in Non-Patent Document 1 is that three communications occur between the device A and the device B. If communication occurs many times, each device must wait for the other device to reply, and the execution speed decreases, so it is preferable that the number of communication is small.

  The second problem is that each device includes an encryption device and a decryption device, and it is necessary to transmit a ciphertext generated by the encryption device. The encryption device must perform heavy calculations, thereby causing a problem that the execution speed of the key exchange is reduced, and a large amount of ciphertext data causes a problem of increasing the communication amount between the devices. .

  A third problem is that each device needs to obtain in advance the public key of the partner device with which the key is exchanged. If the other device does not have the public key, each device will need to communicate further. In particular, since the device A that starts communication first needs to receive the public key pkB from the device B first, at least four times of communication is required.

  In order to solve the above-mentioned problem, the present invention relates to an identifier-based key exchange device, in which two key exchange devices in a system that communicate with each other and share the same key calculate a bilinear map in a multiplicative group. When a system parameter, a system public key, a self-identifier and a self-secret key are input, the long-term storage area and the long-term storage area are stored in the long-term storage area. When a storage means having a function to store, a key exchange start command and a partner identifier are input, a random number is taken to generate a temporary key from the random number, a temporary identifier is generated using the temporary key, Communication means for storing data including the temporary key, the temporary identifier, and the partner identifier in the internal state, and transmitting the data including the temporary identifier to the key exchange apparatus having the partner identifier. With, respectively, the two key exchange devices, based on a device of the other party that communicates to the partner identifier is characterized by being configured so as to be able to authenticate each other.

  According to the key exchange device based on the identifier of the present invention, the authenticated keys can be exchanged by running two key exchange devices.

  Hereinafter, the best mode for carrying out the present invention will be described in detail with reference to the drawings.

Embodiment

  FIG. 1 is a diagram showing a configuration of a secret key issuing device used by a key exchange device in an embodiment of the present invention, and FIG. 2 is a diagram showing a configuration related to activation of the key exchange device in an embodiment of the present invention, FIG. 3 is a diagram showing a configuration related to the start of key exchange of the key exchange device in the embodiment of the present invention, and FIG. 4 is a diagram showing a configuration related to generation of an exchange key of the key exchange device in the embodiment of the present invention. It is.

Hereinafter, description will be given with reference to FIGS. First, the overall configuration of the present invention will be described. In the following description, it is assumed that the key exchange device, provisional identifier generation device, secret key issue device, and the like are configured by computer hardware.
Let q be a prime number, G, G 'be a multiplicative cyclic group of order q, and e be a bilinear map that maps two elements of G to elements of G'. If e is bilinear, e (u ^a , v ^b ) = (u, v) ^ab holds for any element u, v of G and any element a, b of Z / qZ That is.
Let g be a generator of G. Let Hash be a hash function. It is assumed that the key exchange device includes a bilinear map e in groups G and G ′, a field operation device of group operation device Z / qZ, and a hash function operation device. Also assume that the generator g is held.

  Note that Hash is a hash function whose range is Z / qZ, Hash ′ is a hash function whose range is G, and Hash ″ is a hash function whose range is the space of the exchange key. φ represents that the corresponding data is empty. A word enclosed in quotation marks such as “start” is treated as character string data. (q, G, G ', e, g, Hash, Hash', Hash '') are called system parameters.

In addition to the key exchange device, there is a secret key issuing device 100. This device performs the following operation only once before all the key exchange devices are activated. The system parameter 101 and the random number 102 are input, and the system secret key generation device 103 generates a system secret key 104 sεZ / qZ at random. Next, the system public key generation unit 105 generates a z = g ^s as a system public key 106, to expose it. If there is a key issuance request for the identifier 107id after this operation, the secret key generation apparatus 108 calculates y _id = Hash '(id, z), and further calculates x _id = y _id ^s . _Assume that x _id is returned as a secret key 209 with an identifier id.

  The effect key as the exchange result is read by a reading device (not shown) and used by an external application.

At the time of activation, the key exchange device 200 includes a system parameter 201 (q, G, G ′, e, g, Hash, Hash ′, Hash ″), a system public key 202 z, a self-identifier 203 A, and a secret key issuing device. When the self-secret key 204 x _A which is the secret key 109 generated when the self-identifier 203 is input as the identifier 107 is input and activated, 100 generates y _A = Hash ′ (A, z) Then, (q, G, G ′, e, g, Hash, Hash ′, Hash ″), z, A, y _A , and x _A are stored in the long-term storage device 205, and a command waiting state is entered.

  When the key exchange device 200 in the command waiting state receives the key exchange start command 206 and the partner identifier B 207, it operates as follows.

1. The random number 208 is captured.
2. The temporary key generation device 209 generates a temporary key 210r εZ / qZ from the random number 208.
3. Provisional identifier generation unit 211 generates a provisional identifier 212 h _A = g ^r.
4). Store (A, B, h _A , r) in the internal state machine 213.
5. A message 214 (A, B, h _A ) is transmitted to the key exchange apparatus having the identifier B.
6). Enter command wait state.

When the key exchange device in the command waiting state receives the key exchange continuation command 215 and the message 216 (B ′, A, h _{B ′} ), it operates as follows. However, A must be the self-identifier 203 stored in the long-term storage device 205.
Here, the message 216 is generated by the other party's key exchange device, B ′ is the other party's own identifier 217, A is the other party's identifier 218 viewed from the other party, that is, the self identifier 203, and h _{B ′} is the other party's temporary identifier 219. is there.

1. If the data (h ′ ^A , B ′, r ′) exists in the internal state device 213, the process proceeds to the next process.
2. The first hash device 220 has a first hash value 221 u = Hash (h ′ _A , B ′), the second hash device 222 has a second hash value 223 v = Hash (h _{B ′} , A), and a third hash device 224. Generates a third hash value 225 y _{B ′} = Hash ′ (B ′, z).
3. The first element generating unit 226 generates a pairing first elements 227p1 = z ^r x _A ^u, the first element generating unit 228 generates the pairing first elements _{229p2 = h B 'y B'} v.
The pairing-hash device 230 generates the exchange key 231 K = Hash ″ (e (p1, p2)).
4). k is output as the exchange key 231.

When the two key exchange devices described above are run, mutually authenticated keys can be exchanged. This can be confirmed as follows.
In the key exchange device 200, the key exchange device A includes system parameters (q, G, G ′, e, g, Hash, Hash ′, Hash ″), a system public key z, a self identifier A, a self secret key x _A Is entered, y _A = Hash '(A, z) is generated, and (q, G, G', e, g, Hash, Hash ', Hash''), z, A, y _A , x _A are stored in the long-term storage device 205, and a command waiting state is entered.

Key exchange device B is activated by inputting system parameters (q, G, G ', e, g, Hash, Hash', Hash ''), system public key z, self-identifier B, and self-secret key x _B. , Y _B = Hash '(B, z) and (q, G, G', e, g, Hash, Hash ', Hash''), z, B, y _B , x _B The data is saved in the device 205 and enters a command waiting state.

The key exchange device A in the command waiting state receives the key exchange start command and the partner identifier B,
1. Take random numbers,
2. Generate r∈Z / qZ from random numbers,
3. Generate h _A = g ^r
4.Save (A, B, h _A , r) in the internal state,
5. Send the message (A, B, h _A ) to the key exchange device with identifier B,
6. Enter command wait state.

Key exchange device B waiting for command receives key exchange start command and partner identifier A,
1. Take random numbers,
2. Generate t∈Z / qZ from random numbers,
3. Generate h _B = g ^t
4.Save (B, A, h _B , t) in the internal state,
5. Send the message (B, A, h _B ) to the key exchange device with identifier A,
6. Enter command wait state.

Key exchange device A in the command waiting state receives a key exchange continuation command and a message (B, A, h _B )
1. Generate u = Hash (h _A , B), v = Hash (h _B , A), y _B = Hash '(B, z)
2. Generate K = Hash '' (e (z ^r x _A ^u , h _B y _B ^v ))
3. Output K as an exchange key.

Key exchange device B in the command waiting state receives a key exchange continuation command, message (A, B, h _A ),
1. Generate u = Hash (h _A , B), v = Hash (h _B , A), y _A = Hash '(A, z)
2. Generate K '= Hash''(e (z ^t x _B ^v , h _A y _A ^u ))
3. Output K 'as an exchange key.

Here, it is shown that the exchange key K and the exchange key K ′ are equal. this is,
e (z ^r x _A ^u , h _B y _B ^v ) = e (z ^t x _B ^v , h _A y _A ^u )
e (z ^r x _A ^u , h _B y _B ^v )
= E (g ^sr y _A ^su , g ^t y _B ^v )
= E (g ^r y _A ^u , g ^st y _B ^sv )
= E (h _A y _A ^u , z ^t x _B ^v )
= E (z ^t x _B ^v , h _A y _A ^u )
It is.

As described above, the key exchange device A and the key exchange device B succeed in exchanging the same key. Also, it must be used each private key x _A or x _B, those without it even looking at both communications h _A, h _B, it is impossible to know the exchanged key.
Further, even if a person who does not know the secret key x _A generates h _A appropriately and sends it to the key exchange apparatus B, the exchange key generated by the key exchange apparatus B cannot be known.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to the above-described embodiment, and even if there is a design change or the like without departing from the gist of the present invention. Included in the invention. For example, the number of devices that perform key exchange is not limited to two, but may be two key exchange devices selected from a plurality of arbitrary key exchange devices.

  The present invention can be generally used in a system using a common key system in which two key exchange apparatuses communicate with each other and share the same key.

It is a figure which shows the structure of the private key issuing apparatus which the key exchange apparatus uses in embodiment of this invention. It is a figure which shows the structure in connection with the starting of the key exchange apparatus in embodiment of this invention. It is a figure which shows the structure in connection with the time of the key exchange apparatus start in the embodiment of this invention. It is a figure which shows the structure in connection with the production | generation of the exchange key of the key exchange apparatus in embodiment of this invention. It is a figure which shows the structure of the outline of the key exchange system with repudible authentication which is an example of the conventional key exchange system with authentication.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Private key issuing apparatus 101,201 System parameter 102,208 Random number 103 System private key generation apparatus 104 System private key 105 System public key generation apparatus 106,202 System public key 107 Identifier 108 Private key generation apparatus 109 Private key 200 Key exchange apparatus 202 System public key 203,232 Self-identifier 204 Self-secret key 205 Long-term storage device 206 Key exchange start command 207 Partner identifier 209 Provisional key generation device 210 Provisional key 211 Provisional identifier generation device 212 Provisional identifier 213 Internal state device 214, 216 Message 215 Key exchange continuation instruction 217 (partner) self identifier 218 (partner) partner identifier 219 (partner) provisional identifier 220 first hash device 221 first hash value 222 second hash device 223 first Second hash value 224 Third hash device 225 Third hash value 226 First element generation device 227 Pairing first element 228 Second element generation device 229 Pairing second element 230 Pairing-hash device 231 Exchange key

Claims (5)

Two key exchange devices in a system that communicate with each other and share the same key,
An arithmetic means having an arithmetic part for calculating a bilinear map in a multiplicative group;
A long-term storage area and an area for saving the internal state are set, and when a system parameter, system public key, self-identifier and self-secret key are input, the long-term storage area has a function to save them in the long-term storage area Storage means;
When a key exchange start command and a partner identifier are input, a random number is fetched to generate a temporary key from the random number, a temporary identifier is generated using the temporary key, and data including the temporary key, the temporary identifier, and the partner identifier Communication means for storing data in the internal state and transmitting data including the temporary identifier to a key exchange device having a partner identifier,
An identifier-based key exchange device, wherein the two key exchange devices are configured to be able to authenticate each other device with which communication is performed based on the identifier of the other device. Two key exchange devices in a system that communicate with each other and share the same key,
An arithmetic means having an arithmetic part for calculating a bilinear map in a multiplicative group;
A long-term storage area and an area for saving the internal state are set, and when a system parameter, system public key, self-identifier and self-secret key are input, the long-term storage area has a function to save them in the long-term storage area Storage means;
When a key exchange start command and a partner identifier are input, a random number is fetched to generate a temporary key from the random number, a temporary identifier is generated using the temporary key, and data including the temporary key, the temporary identifier, and the partner identifier Communication means for storing data in the internal state and transmitting data including the temporary identifier to a key exchange device having a partner identifier,
The two key exchange devices generate a bilinear mapping image of two pairing elements, and output the hash function image as an exchange key, thereby reducing the number of times of communication for key exchange. A key exchange device based on an identifier, characterized in that the devices to be performed can be mutually authenticated based on the identifier of the partner.   When each key exchange device receives a message including a key exchange continuation command and the other party's provisional identifier, the respective hash values of two types of data including a temporary identifier, a self-identifier, and part or all of the other party identifier are used. 3. The key exchange device based on an identifier according to claim 1 or 2, wherein a first hash value and a second hash value are generated, and a third hash value that is a hash value of data including a counterpart identifier is generated. .   Each key exchange device has a product of a product obtained by multiplying a system public key by a provisional key and a product obtained by multiplying a self-secret key by the first hash value as a first pairing element, the provisional identifier of the other party, 4. The identifier-based key exchange device according to claim 3, wherein a product of a third hash value multiplied by the second hash value is generated as a pairing second element.   5. The identifier based on claim 4, wherein a bilinear map of the pairing first element and the pairing second element is generated and an image of a hash function of the bilinear map is output as an exchange key. Key exchange device.

Images