JPH04345232A - Verification method - Google Patents

Abstract

PURPOSE:To reduce number of times of communication while keeping safety and high reliability without loss of the safety and high reliability even in the case of parallel processing by devising the method such that a certificated party indicates that the certificated party knows any ciphered plain sentence among ciphered sentences sent from a verification party through the interaction with the verification party in a way that the verification party is unaware of which of the ciphered sentences is known by the certificated party. CONSTITUTION:A certificated side equipment 9 consists of a random number generator 1, a memory 2, a computing element 3 and a decoder 4, and a verification party equipment 10 consists of a random number generator 6, a memory 7, and a computing element 8, and both the equipments make data communication through a communication line 5. Through the constitution above, the certificated party sends ciphered sentences resulting from ciphering at least two plain sentences at random to the verification party and suggests that the certificated party knows any one plain sentence among the ciphered sentences through the interaction with the verification party in a way that the verification party is unaware of which of the said ciphered sentences is known by the certificated party. The certificated party gets verification by indicating through the interaction with the verification party it that the certificated party knows any plain sentence among ciphered sentences sent from the verification party in a way that the verification party does not recognize which of the sentences the certificated party knows. Thus, number of times of communication is reduced without loss of the safety and high reliability even in the case of parallel processing.

Description

[Detailed description of the invention]

0001

[Industrial Application Field] The present invention is applicable to other party authentication (e.g., to authenticate that the person on the other end of the phone call is really the person you are talking to), and personal authentication (e.g., to prove to the other party or others that you are really the person you are talking to). This relates to an authentication method that performs the following:

0002

[Background Art] Conventionally, in authentication in the field of encrypted communication, the person and the verifier verify who knows a certain secret information S (for example, a password or ID number) (hereinafter referred to as the certifier). Authentication is being performed. Among these authentication methods, many cryptographic authentication methods based on zero-knowledge proof technology have been proposed. A typical authentication method is the so-called Fiat-Shamir method (U.S. Pat. No. 4,748,6) proposed by Fiat and Shamir.
It is disclosed in the specification of No. 68. ), the (integrity) verifier recognizes the person who knows the secret information S as the principal. (Soundness) The verifier does not recognize a person who does not know the secret information S as the principal. (Zero knowledge) The prover only tells the verifier that he knows the secret information S, and does not divulge any information regarding the secret information S. In this sense, it is safe against any kind of attack (for example, spoofing, wiretapping, etc.) and is a promising authentication method. In addition, recently, cryptography is based on zero-knowledge proofs that not only show that one knows a certain secret information S, but also show that one has some kind of computational ability (for example, one has found an algorithm for breaking a certain code). Authentication methods have been proposed. This type of method includes, for example, M
．． Tompa and H. Woll,”Rand
om Self-Reducibility an
d Zero-Knowledge Intera
Active Proofs of Posscs
sion of Information,”IE
EE Annual Symposium on
Foundation of Compute
r Science, pp. 472-482 (1987
), there was a method of proving to the verifier that one knew the prime factorization of the composite number N using a zero-knowledge proof.

This conventional example will be explained below with reference to FIG. Step A-0) The verifier is

0004

[Math 1]

Randomly select 0005,

[0006]

[Math 2]

Calculate [0007] and send x to the prover. Step A
-1 to step A-4 are repeated. Step A-1) The verifier:

[0008]

[Math 3]

Randomly select 0009,

0010

[Math 4]

Calculate y and send it to the prover. Step A-2) The prover is

0012

[Math 5]

[0013] is randomly and uniformly selected and sent to the verifier. Step A-3) The verifier:

[0014]

[Math 6]

[0015] is sent to the prover. Step A-4) The prover is

[0016]

[Math 7]

Check [0017]. Repeat steps B-1 to B-4. Step B-1) The prover is

[0018]

[Math. 8]

Randomly select 0019,

[0020]

[Math. 9]

Calculate [0021] and send u to the verifier. Step B-2) The verifier is

[0022]

[Math. 10]

[0023] is randomly and uniformly selected and sent to the prover. Step B-3) The prover:

[0024]

[Math. 11]

The number that satisfies 0025

[0026]

[Math. 12]

Calculate [0027] and further

[0028]

[Math. 13]

[0029] is calculated and v is sent to the verifier. Step B-4) The verifier is

[0030]

[Math. 14]

Check whether the following holds true. If true, the verifier determines that the prover is valid. Otherwise, the verifier determines the prover to be invalid.

[0032]

[Problem to be solved by the invention] Since the conventional authentication method is configured as described above, in order to improve reliability and security, it is necessary to increase the number of communications between the prover and the verifier. However, as a way to increase reliability without increasing the number of communications, it is possible to process the conventional steps in parallel. The problem is that it is difficult to reduce the number of communications while maintaining safety and high reliability because safety is not guaranteed in this case. This invention was made to solve the above problems, and it is possible to reduce the number of communications while maintaining safety and high reliability without compromising safety and high reliability even when parallel processing is performed. The purpose is to obtain an authentication method that can be used.

[0033]

[Means for Solving the Problems] A first invention related to an authentication method of the present invention is an authentication method that shows a verifier that a prover has the ability to decrypt a given code.
The verifier randomly encrypts at least two plaintexts and sends them to the prover, and the verifier does not know which one of the above ciphertexts it is. Through dialogue with the prover, the prover knows the plaintext of one of the ciphertexts sent from the verifier, without letting the verifier know which one it is. Authentication is obtained by demonstrating this through dialogue with the verifier. Further, a second invention is an authentication method according to claim 1, which is an authentication method for indicating to a verifier that the prover knows the prime factorization of a composite number N consisting of the product of two or more prime numbers. , authentication is obtained by showing the verifier that the prover has the ability to decipher the Rabin cipher modulo N. In addition, the third invention is an authentication method that shows a verifier that the prover knows the prime factorization of a composite number N consisting of the product of two or more prime numbers, which verifies that the prover has the ability to decipher the Rabin cipher. This is an authentication method in which the verifier randomly encrypts one plaintext and sends the ciphertext to the prover, and the verifier encrypts the encrypted text in the first step. The second step is to show that you know the plaintext of one of the sentences by interacting with the prover without letting the prover know which one it is, and the prover knows the plaintext of one of the sentences sent by the verifier. and a third step of indicating that one of the plaintexts among the ciphertexts is known through dialogue with the verifier without the verifier knowing which one it is, and at least the second step described above. and the third step operate in parallel to obtain authentication.

[0034]

[Operation] In this invention, the prover can convince the verifier that he/she has the ability to decipher the given code without disclosing anything, so secure authentication can be performed.
Furthermore, by repeating the steps in parallel, the reliability of authentication can be increased to any extent without compromising security, and an authentication method that can reduce the number of communications while maintaining safety and high reliability can be obtained.

[0035]

DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing one embodiment of the present invention. In the figure, 1 is a random number generator that generates random numbers by the operation of the prover, 2 is the prover side memory that stores the random numbers generated by the prover and data sent from the verifier, and 3 is the random number generator that generates random numbers by the operation of the prover. A computing unit that performs normal calculations, 4 a decryptor that decrypts the code under the operation of the prover, 5 a normal communication line for exchanging data between the prover and the verifier, 6
is a random number generator that generates random numbers through the operation of the verifier; 7 is the prover side memory that stores random numbers generated by the verifier and data sent from the prover; and 8 is the memory that performs normal calculations through the operation of the verifier. The random number generator 1, memory 2, arithmetic unit 3, and decoder 4 constitute a prover side device 9, and the random number generator 6, memory 7, and arithmetic unit 8 constitute a verifier side device 10. is configured.

In this embodiment, the encryption function is

003
7]

[Math. 15]

Considering the following, the prover wants to demonstrate to the verifier the ability to calculate the inverse function (ie, discrete logarithm) of D(x).

Next, the operation will be explained. In step (1), the verifier uses the random number generator 6 to randomly select 0≦w[
1i], w[2i]<p (1≦i≦n), and (w[1i], x[2i]) (1≦i≦n) is stored in the memory 7 and the arithmetic unit 8 Using,

[0040]

[Math. 16]

[0041]

[Math. 17]

Calculate (x[1i],x[2i])(
1≦i≦n) in the memory 7 and the random number generator 6
, randomly set 0<r[1ij], r[2ij]<p(1≦i, j≦n
) secretly generate (r[1ij],r[2ij])(1
≦i, j≦n) in the memory 7 and using the arithmetic unit 8,

[0043]

[Math. 18]

[0044]

[Math. 19]

Calculate (y[1ij], y[2ij]
) (1≦i, j≦n) in the memory 7, and using a random number generator, randomly

[0046]

[Math. 20]

, and store q[ij] (1≦i, j≦n) in the memory 7, and if q[ij]=0, (z[1ij], z[2ij])=(y[ 1ij],y
[2ij]), if q[ij] = 1, then (z[1ij], z[2ij]) = (y[2ij], y
[1ij]), and (z[1ij], z[2ij]) (1≦i,
j≦n) in the memory 7, and (x[1i], x[2i]), (z[1ij], z"2
ij]) (1≦i, j≦n) to the prover through the communication line 5. In step (2), the prover receives the data (x[1
i], x[2i]), (z[1ij], z[2ij])
(1≦i, j≦n) is stored in memory 2 and randomly generated using random number generator 1.

[0048]

[Math. 21]

Select [0049], store e[ij] (1≦i, j≦n) in the memory 2, and also use the random number generator 1,
Randomly 0<t[1ij], t[2ij]<p(1≦
i, j≦n) and (t[1ij], t[2ij]
) (1≦i, j≦n) in the memory 2 and using the arithmetic unit 3,

[0050]

[Math. 22]

[0051]

[Math. 23]

Calculate (u[1ij], u[2ij]
) (1≦i, j≦n) in the memory 2 and randomly using the random number generator 1.

[0053]

[Math. 24]

Select s[ij] (1≦i, j≦n) in the memory 2, and if s[ij]=0, (v[1ij], v[2ij])=(u[ 1ij], u
[2ij]), if s[ij] = 1, then (v[1ij], v[2ij]) = (u[2ij], u
[1ij]), e[ij], (v[1i
j], v[2ij]) (1≦i, j≦n) to the prover. In step (3), the verifier sends the data e[ij], (v[1ij], v[2ij]) (1
≦i, j≦n) in the memory 7, and the verifier:
In a random manner

[0055]

[Math. 25]

[0056] and store f[ij] (1≦i, j≦n) in the memory 7, as well as e[ij], q from the memory 7.
[ij], r[1ij], r[2ij], w[1ij]
, w[2ij] and receives e[ij]=0, if q[ij]=0 then (a[1ij], a[2ij])=(r[1ij], r
[2ij]) If q[ij] = 1, then (a[1ij], a[2ij]) = (r[2ij], r
[1ij]) and when e[ij]=1 is received, when q[ij]=0, h[ij]=r[1ij]+w
[1ij] mod p −1, when q[ij]=1, h[ij]=r[2ij]+w
[2ij] mod p −1, calculate f[ij], (a[1ij], [2ij])
, h[ij] (1≦i, j≦n) to the prover through the communication line 5. In step (4), the prover uses the data f[ij], (a[1ij], a[2ij]), sent from the verifier.
h[ij] (1≦i, j≦n) is stored in memory 2, and from memory 2 x[1i], x[2i], z[1ij
], z[2ij], y[ij], t[1ij], t[2
ij] and using arithmetic unit 3, for e[ij]=0,

[0057]

[Math. 26]

[0058]

[Math. 27]

For e[ij]=1,

[0060]

[Math. 28]

Check whether the following holds true. Further f
If [ij] = 0 is received, use arithmetic unit 3 to calculate s
If [ij] = 0, then (b[1ij], b[2ij]) = (t[1ij], t
[2ij]) If s[ij] = 1, then (b[1ij], b[2ij]) = (t[2ij], t
[1ij]) and (b[1ij],b[2ij])(1≦i
, j≦n) to the verifier through the communication line 5. If f[ij]=1 is received, use decoder 4 to

[0062]

[Math. 29]

[0063]

[Math. 30]

Calculate w[1ij] and w[1ij] satisfying
d p-1, if s[ij]=1, then k[ij]
=t[2ij]+w[2ij] mod p-1 is calculated, and k[ij] (1≦i, j≦n) is connected to the communication line 5.
to the verifier through. In step (5), the verifier retrieves f[ij] from memory.
, v[1ij], v[2ij], x[1i], x[2i
], and for f[ij]=0,

0065
]

[Math. 31]

[0066]

[Math. 32]

For f[ij]=1,

[0068]

[Math. 33]

Check whether the following holds true. If it holds true, the prover is accepted as correct; otherwise, it is rejected as an invalid prover.

[0070] Also, as an encryption function, the encryption function of the Rabin cipher is used.

[0071]

[Math. 34]

If we consider the following, the prover can show the verifier that he knows the prime factorization of N.

In this case, the operation is as follows. In step (1), the verifier randomly

007
4]

[Math. 35]

Generate [0075] and use an arithmetic unit to calculate

[0076]

[Math. 36]

[0077] At the same time as calculation, a random number generator is used to randomly

[0078]

[Math. 37]

Generate [0079] and use an arithmetic unit,

[0080]

[Math. 38]

[0081] is calculated and sent to the prover via the communication line. In step (2), the prover uses a random number generator to randomly

[0082]

[Math. 39]

Generate [0083] and use an arithmetic unit to calculate

[0084]

[Math. 40]

Calculate e[ij], Z[ij] (1≦
i, j≦n) to the prover via the communication line. In step (3), the verifier uses a calculator to

0086
]

[Math. 41]

Calculate [0087] and use a random number generator to randomly select

[0088]

[Math. 42]

[0089] and f[ij], Z[ij] (1≦
i, j≦n) to the prover via the communication line. In step (4), the prover:

[0090]

[Math. 43]

It is checked whether the following holds true, and if it does not hold, the process stops. Otherwise, using a decoder,

0092
]

[Math. 44]

0093

[0094]

[Math. 45]

Calculate 0095,

[0096]

[Math. 46]

[0097] is sent to the verifier via the communication line. In step (5), the confirmer uses a calculator to

009
8]

[Math. 47]

Check whether the following holds true. If it holds true, the prover is accepted as correct; otherwise, it is rejected as an invalid prover.

[0100] In addition, although the parallel processing method has been described as an example above, it is also possible to simply repeat the processing in series to improve reliability.

[0101]

As described above, according to the authentication method of the present invention, security and high reliability are not impaired even when parallel processing is performed, and communication can be performed while maintaining security and high reliability. This has the effect of providing an authentication method that can reduce the number of times of authentication. Further, according to the second invention, when Rabin encryption is used, security and high reliability are not impaired even when parallel processing is performed, and the number of communications can be reduced while maintaining security and high reliability. There is an effect that can be obtained by the method. Also,
According to the third invention, when the verifier randomly encrypts one plaintext using the Rabin cipher and sends the ciphertext to the prover, security and high reliability are not impaired even if parallel processing is performed. This has the effect of providing an authentication method that can reduce the number of communications while maintaining safety and high reliability.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing one embodiment of the present invention.

FIG. 2 is a block diagram showing an example of a conventional authentication method.

[Explanation of symbols]

1 Random number generator 2 Memory 3 Arithmetic unit 4 Decoder 5 Communication line 6 Random number generator 7 Memory 8 Arithmetic unit 9 Prover side device 10 Verifier side device

Claims (3)

[Claims] Claim 1: In an authentication method that shows a verifier that the prover has the ability to decrypt a given code, the verifier randomly sends at least two ciphertexts to the prover, and determines which of the ciphertexts The prover knows one plaintext by interacting with the prover without the prover knowing which one it is, and the prover knows one of the ciphertexts sent from the verifier. An authentication method characterized by obtaining authentication by demonstrating knowledge of one plaintext through dialogue with a verifier without the verifier knowing which one it is. 2. An authentication method according to claim 1, which shows the verifier that the prover knows the prime factorization of a composite number N consisting of the product of two or more prime numbers,
An authentication method characterized in that a prover obtains authentication by showing a verifier that he or she has the ability to decipher a Rabin cipher modulo N. [Claim 3] An authentication method for showing a verifier that the prover knows the prime factorization of a composite number N consisting of the product of two or more prime numbers, which shows the verifier that the prover has the ability to decipher the Rabin cipher. This is an authentication method in which the verifier randomly encrypts one plaintext and sends the ciphertext to the prover, and the verifier selects which of the ciphertexts in the first step. The second step is to demonstrate that the prover knows one plaintext by interacting with the prover without the prover knowing which one it is, and the prover knows the ciphertext sent by the verifier. a third step of indicating that one of the plaintexts is known through dialogue with the verifier without the verifier knowing which one it is, and at least the second step and the third step. This is an authentication method characterized in that the steps of are performed in parallel to obtain authentication.