JPH10177341A - Method and system for depositing secret key for ras cipher - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to more safely hold a secret key without always carrying a storage medium. SOLUTION: The secret key out of user's disclosed key and secret key is divided into two parts (S1) and the 1st divided secret key is stored by user's entity A (S2). Then the 2nd divided secret key is deposited in the other entity B (S3) and the 2nd divided secret key is delivered to the user's entity A based on a request (S5) from the entity A (S6). The entity A combines the stored 1st divided secret key and the 2nd divided secret key delivered from the entity B to obtain the secret key for an RSA cipher (S7).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to providing a client service in a computer network environment such as a client / server system, such as user authentication and confidential communication using the RSA encryption method, between a client and a server. The present invention relates to a method and system for depositing a private key of a user in a trusted organization such as a key management server and changing the deposited key in RSA cryptography.

[0002]

2. Description of the Related Art In recent years, with the spread of downsizing and the Internet, efforts for security in an open computer network environment have been actively made.

For example, PEM (Privacy Enhanced Mail)
) Is standardized by the IETF on the Internet as the first encrypted mail standard that incorporates a cryptographic description, and a specification is currently issued as RFC (Request for comments).

In order to perform secure communication in such a network, it is essential to guarantee the confidentiality (privacy) of communication data and the authenticity (authenticity) of a user by user authentication. Is realized by using encryption technology.

For example, the public key cryptosystem is a cryptosystem in which the key used for encryption (encryption key) and the key used for decryption (decryption key) are different, and it is difficult to guess the decryption key from the encryption key. is there. Users who use public key cryptography have their own encryption and decryption keys, and when a sender sends a message to a recipient, the sender uses the disclosed recipient's encryption key. The receiver can perform confidential communication by encrypting and decrypting with the decryption key of the receiver. Also, by reversing the order of encryption and decryption, only the person holding the decryption key (private key) can digitally sign, and anyone who knows the person's encryption key (public key) can verify it. .
By utilizing this feature, it is possible to authenticate the communication partner and prove the communication fact.

[0006] Typical ciphers of the public key cryptosystem include:
RSA encryption method (RLRivest, A. Shamir and L. Adlema
n, "A Method for Obtaining Digital Signatures an
d Public-key Cryptosystems ”, Communications of th
e ACM, Vol 21 (2), pp.120-126, Feb.1978) are well known.

[0007]

However, when the above-mentioned conventional secure communication is performed using encryption technology,
User-specific private keys must be managed in a secure manner. Therefore, for example, by holding the secret key in a storage medium having a cryptographic processing function such as a smart card, the key cannot be easily taken out from the outside of the card. In the case of using a highly secure method such as outputting only data that has been subjected to encryption processing calculation based on the secret key, encrypting and holding the secret key with a key decryption key generated based on the user's password phrase, Generates the same key decryption key again by giving the password known to the correct user when needed, decrypts the encrypted private key,
The method of taking out is used. The latter method is based on PKCS ("Private") proposed by the RSA Research Institute as a standard for implementation when using public encryption technology.
ate-Key Information Syntax Standard ”, Version 1.
2, RSA Data Security Inc., Nov. 1993).

However, in the former method, the user must always carry a private key held in a storage medium such as a smart card, and in the latter method, if the encrypted private key is decrypted, There is a problem that if it is done, it can impersonate the correct user.

[0009] Further, it is possible to improve security by shortening the key change cycle. However, in a public key cryptosystem such as the RSA encryption, a key pair is generated without permission and falsely impersonated by others. A public key certificate, usually signed by a trusted third party or the private key of another user that you trust, to guarantee the association between you and its public key A letter is issued. When mutually authenticating between users, the public key certificate of the other party is verified with the public key of the third party (or another trusted user), and the other party's user name and its public key are verified. Use after confirming the correctness. However, when the key is changed, if the private key is changed, the public key is also changed. Therefore, the public key certificate that has already been issued and that has been published among many users must be changed each time. There is a problem that it is necessary and management is complicated.

[0010] The present invention has been made in view of the above points, and does not always carry a storage medium as in the related art.
RSA that can realize more secure secret key storage
It is an object of the present invention to provide a secret key escrow method and system in cryptography.

The present invention also uses a user's private key by dividing the user's private key into two or more, and changes a divided secret key obtained from the user's private key without changing the user's public key. It is an object of the present invention to provide a secret key escrow method and system in RSA encryption that can be performed.

[0012]

In order to solve the above problems, the present invention divides a secret key of a user's public key and secret key used in the RSA cryptosystem into two by a user entity, A first split secret key of the split secret keys is held at the user entity, and a second split secret key of the split secret keys is deposited from the user entity to another entity. In response to a request from the user entity, delivering the second split secret key from the other entity to the user entity, wherein the first split secret stored in the user entity is stored. Combining the key with the second split secret key delivered from the other entity,
Provided is a secret key escrow method in RSA encryption, characterized in that a secret key used for processing by an encryption method is obtained.

Further, in the present invention, the user entity encrypts the second divided secret key with an encryption key so that the second divided secret key can be decrypted with a key decryption key known only to the user entity. Depositing the obtained second divided secret key with the other entity, the other entity:
In response to a request from the user entity, deliver the encrypted second divided secret key to the user entity, and the user entity sends the encrypted second divided secret key to the user entity. The second divided secret key is obtained by decrypting with the key decryption key.

In the present invention, the encryption key and the key decryption key are a common key generated by the user entity.

Further, in the present invention, the common key is a hash value obtained by the user entity from the first divided secret key using a one-way hash function.

In the present invention, the encryption key is the second divided secret key itself, and the key decryption key is:
It is characterized by comprising the first divided secret key and the public key.

In the present invention, the other entity holds the second divided secret key together with the public key,
In response to a request from the user entity, the second
Distributes the public key to the user entity together with the divided private key of the above, and the user entity decrypts the held first divided secret key and the public key distributed from the other entity to the key. It is characterized in that it is used as an encryption key.

Further, in the present invention, the user entity encrypts the second divided secret key with the second divided secret key itself, and further encrypts the encrypted second divided secret key with the user. An escrow key is obtained by encrypting the escrow key with a common key that only the entity can know, and the escrow key is escrowed with the other entity, and the other entity replaces the escrow key with the request from the user entity. Delivering to the user entity, the user entity decrypts the escrow key with the common key to obtain the encrypted second divided secret key, and obtains the encrypted second divided secret key. The second divided secret key is obtained by decrypting with the first divided secret key and the public key.

Further, in the present invention, the common key is a hash value obtained by the user entity from the first divided secret key using a one-way hash function.

In the present invention, the other entity holds the second divided secret key together with the public key,
In response to a request from the user entity, the second
Distributes the public key to the user entity together with the divided private key of the user, and the user entity encrypts the public key by using the held first divided secret key and the public key distributed from the other entity. The decrypted second divided secret key is decrypted.

Further, in the present invention, the first divided secret key is stored in the user entity as a password stored by the user.

Further, in the present invention, when the password is input by the user, the user entity requests the other entity to deliver the second divided secret key to the other entity. Features.

In the present invention, the user entity may request the other entity to deliver the second divided secret key to the other entity when the user performs a process according to the RSA encryption method. It is characterized by.

In the present invention, together with the second divided secret key, the prime numbers p and q used at the time of generating the secret key are deposited with the other entity, and the other entity is The prime number p and the prime number q together with the second divided secret key in response to a request from a user entity.
To the user entity, the user entity receives the secret key obtained by combining the first divided secret key and the second divided secret key, and the Using the prime numbers p and q to change the public keys of new first and second divided secret keys different from the first and second divided secret keys. It is characterized by generating without.

Further, according to the present invention, of the user's public key and private key used in the RSA encryption method, the private key is divided into a plurality of pieces by a user entity, and one of the divided The key is held in the user entity, and each of the remaining divided secret keys among the divided secret keys is escrowed from the user entity to another different entity, and upon request from the user entity, In response, the remaining split secret key is delivered from each of the other entities to the user entity, where the one split secret key retained and delivered from the other entity is delivered to the user entity. Combining the remaining divided secret keys to obtain a secret key to be used for processing by the RSA encryption method; To provide a method.

In the present invention, together with the remaining divided secret keys, the prime numbers p and q used at the time of generating the secret key are deposited in any of the other entities,
Any of the other entities, in response to a request from the user entity, deliver the prime p and the prime q to the user entity together with the remaining divided secret key, wherein the user entity Using the secret key obtained by synthesizing the split secret key and the remaining split secret key, and the prime numbers p and q delivered from any of the other entities, the one split secret key and the remaining And generating a plurality of new divided secret keys different from the divided secret key without changing the public key.

Further, the present invention is a secret key escrow system in an RSA cryptosystem comprising a user entity and another entity, wherein the user entity includes an RSA
Secret key splitting means for splitting the secret key into two out of the user's public key and secret key used in the cryptosystem, and first splitting of the split secret key held by the user entity Key escrow means for escrowing the remaining second divided secret key excluding the secret key to another entity; requesting the other entity to deliver the second divided secret key; A divided secret key obtaining means for receiving a divided secret key; combining the first divided secret key held in the user entity with the second divided secret key delivered from the other entity; Secret key synthesizing means for obtaining a secret key used for processing by an encryption method; and a secret key escrow system in RSA encryption.

Further, in the present invention, the key escrow means encrypts the second divided secret key with an encryption key so that the second divided secret key can be decrypted with a key decryption key known only to the user entity. Depositing the encrypted second divided secret key with the other entity, and the other entity stores the encrypted second divided secret key in response to a request from the user entity. Delivered to
The secret key combining means decrypts the encrypted second divided secret key with the key decryption key to obtain the second divided secret key.

Further, in the present invention, the encryption key and the key decryption key are a common key generated by the user entity.

Further, in the present invention, the common key is a hash value obtained by the user entity from the first divided secret key using a one-way hash function.

In the present invention, the encryption key is the second divided secret key itself, and the key decryption key is
It is characterized by comprising the first divided secret key and the public key.

Further, in the present invention, the other entity holds the second divided secret key together with the public key,
In response to a request from the user entity, the second
The public key is distributed to the user entity together with the divided secret key of the above, and the secret key synthesizing means is configured to distribute the first divided secret key held in the user entity and the other entity distributed from the other entity. A public key is used as the key decryption key.

Further, in the present invention, the key escrow means encrypts the second divided secret key with the second divided secret key itself, and further encrypts the encrypted second divided secret key with the user. An escrow key is obtained by encrypting the escrow key with a common key that only the entity can know, and the escrow key is escrowed with the other entity, and the other entity replaces the escrow key with the request from the user entity. Delivered to the user entity, the secret key synthesizing means decrypts the escrow key with the common key to obtain the encrypted second divided secret key, and obtains the encrypted second divided secret key. The first
And the second divided secret key is obtained by decryption using the divided secret key and the public key.

Further, in the present invention, the common key is a hash value obtained by the one-way hash function from the first divided secret key in the user entity.

In the present invention, the other entity holds the second divided secret key together with the public key,
In response to a request from the user entity, the second
The public key is distributed to the user entity together with the divided secret key of the above, and the secret key synthesizing means is configured to distribute the first divided secret key held in the user entity and the other entity distributed from the other entity. The encrypted second divided secret key is decrypted with a public key.

In the present invention, the first divided secret key is stored in the user entity as a password stored by the user.

In the present invention, when the password is input by the user, the divided secret key acquisition means requests the other entity to deliver the second divided secret key. It is characterized by the following.

[0038] In the present invention, the divided secret key obtaining means requests the other entity to deliver the second divided secret key to the other entity when the user performs a process using the RSA encryption method. It is characterized by doing.

In the present invention, the key escrow means also deposits, with the second divided secret key, the prime numbers p and q used at the time of generation of the secret key to the other entity, and The entity distributes the prime numbers p and q together with the second divided secret key to the user entity in response to a request from the user entity, and the secret key synthesizing means transmits the first divided secret Using the secret key obtained by synthesizing the key and the second divided secret key, and the prime numbers p and q distributed from the other entity, the first divided secret key and the second A new first divided secret key and a second divided secret key different from the divided secret key are generated without changing the public key.

Further, the present invention is a secret key escrow system in RSA cryptography comprising a user entity and another entity, wherein the user entity includes an RSA
Secret key dividing means for dividing the secret key into a plurality of public keys and private keys of a user used in the encryption method, and one divided secret key held in the user entity among the divided secret keys Key escrow means for escrowing each of the remaining divided secret keys except for the other entity, and requesting each of the other entities to distribute the remaining divided secret key, and distributing the remaining divided key. Divided secret key obtaining means for receiving a secret key, and synthesizing the one divided secret key held in the user entity and the remaining divided secret key delivered from the other entity,
Secret key synthesizing means for obtaining a secret key to be used for processing by the RSA encryption method.

Further, in the present invention, the key escrow means escrows the prime numbers p and q used at the time of generation of the secret key, together with the remaining divided secret keys, to one of the other entities. Any of the following entities distributes the primes p and q together with the remaining divided secret keys to the user entity in response to a request from the user entity, and the secret key synthesizing means Using the secret key obtained by synthesizing the secret key and the remaining divided secret key, and the prime numbers p and q delivered from any of the other entities, the one divided secret key and the remaining A plurality of new divided secret keys different from the divided secret key are generated without changing the public key.

[0042]

FIG. 1 shows a schematic configuration of a system to which the present invention is applied, and FIG. 2 shows an outline of a secret key escrow method according to a first embodiment of the present invention.

The system shown in FIG.
00, entity B300 and other entities 40
0, and the entity A200 divides the secret key of the user's public key and secret key used in the RSA encryption method into two (S1), and divides one of the two into the divided secret key (the first divided secret key). ) Is held (S2). The other divided secret key (second divided secret key) is entity B30.
0 (S3), and the entity B300 holds it (S4).

Here, the secret key to be divided is a Multiple-K
ey cipher (CABoyd, “Some Applications of Multiple
Key Ciphers ", Proceedings of Eurocrypt 88, Spri
nger-Verlag, 1988), the secret key satisfies the congruence expressed by the following expression 1.

[0045]

Kp × ks1 × ks2≡1 (mod L) (1) Here, ks1 is a first divided secret key, ks2 is a second divided secret key, and kp is a public key. L is (p−
1) is the least common multiple of (q-1), p and q are any different large prime numbers, and in the following n is
It is the product of p and q.

That is, the entity A 200 encrypts its own second divided secret key in advance so that it can be decrypted with a key decryption key known only to the entity A 200, and deposits it in the entity B 300. Here, the encryption key to be encrypted so as to be decrypted with the key decryption key and the key decryption key is:
For example, DES encryption (FIPS pub 46, “Data Encry
ption Standard ”, NBS, 1977), FEAL encryption (Miyaguchi, Shiraishi, Shimizu,“ FEAL-8 encryption algorithm ”,
(Research report, 37, 4/5, pp. 321-227, 1988). A common key can be used as a common key based on a common key encryption method in which an encryption key and a decryption key are the same common key. Yes, and RSA
According to the encryption method, the second divided secret key can be used as an encryption key, and the first divided secret key and the public key can be used as a key decryption key.

Further, by combining the above two methods, the amount of calculation for decrypting the encrypted second divided secret key is increased, and it is more difficult to attack the key used for encryption. You can also

Next, the entity A 200 issues a request for obtaining the second divided secret key to the entity B 300 (S 5), and the entity B 300
Stores the held second divided secret key in entity A2
00 (S6).

Here, when the entity A 200 has the second divided secret key delivered from the entity B 300, the entity A 200 issues a second divided secret key acquisition request of the entity A 200. The entity B300 receives the second divided secret key acquisition request, searches for the second divided secret key that is securely protected by being encrypted with the encryption key,
The second secret key is delivered to the entity A200.

Next, the entity A 200 performs an authentication process with the other entity 400 using the secret key obtained by synthesizing the first divided secret key held by itself and the distributed second divided secret key (S 7). At this time, the entity A20
0, when the encrypted second divided secret key is obtained,
A key decryption key for decrypting the key is extracted, the second divided secret key is decrypted, and the second divided secret key is extracted. As a result, only the entity A200 that knows the correct key decryption key can obtain the second divided secret key, and furthermore, simultaneously obtains the obtained second divided secret key and the first divided secret key. By using this, the RSA encryption process is performed as the user's secret key, and authentication is performed with the other entity 400.

FIG. 3 shows the configuration of the secret key escrow system in the first embodiment of the present invention.

The secret key escrow system shown in FIG. 3 includes an entity A 200 and an entity B 300.

The entity A 200 includes the key dividing unit 20
5, a key escrow unit 206, a key storage unit 203, a escrow key acquisition request unit 204, a escrow key reception unit 208, a escrow key extraction unit 209, and a secret key synthesis unit 210.

The entity B 300 includes a deposit key acquisition request receiving unit 305, a deposit key storage unit 306, and a deposit key distribution unit 307.

The key division unit 205 divides the secret key used in the RSA encryption system into two, and transfers one of the first divided secret keys to the key storage unit 203 and the other of the second divided secret keys. The key is transferred to the key escrow unit 206 as a escrow key.

The key deposit unit 206 deposits the deposit key divided by the key dividing unit 205 with the entity B300.

The key storage unit 203 stores the first divided private key.
Is stored.

The escrow key acquisition request unit 204 issues a request for acquiring the escrowed key to the entity B300.

The escrow key receiving unit 208 is provided for the entity B3
A deposit key is obtained from 00.

The escrow key extracting unit 209 obtains a key decryption key for decrypting the escrow key from the key storage unit 203, and decrypts the escrow key.

The secret key synthesizing unit 210 performs authentication with another entity 400 by synthesizing and using the decrypted escrow key and the first divided secret key.

Deposit key storage unit 3 of entity B300
Reference numeral 06 stores a deposit key deposited from the entity A200.

The escrow key acquisition request receiving unit 305 receives the escrow key acquisition request from the entity A 200, searches the escrow key storage unit 306 based on the request, and transfers the obtained escrow key to the escrow key distribution unit 307. I do.

As a result, the escrow key distribution unit 307 distributes the escrow key to the entity A200.

Next, a specific example of the secret key escrow system according to the first embodiment of the present invention will be described.

First, examples of variables and functions used in the following description will be described.

Kp is the user's RSA public key, ks1,
ks2 is a division key of the user's RSA private key, and each of the keys kp, ks1, and ks2 is determined so as to satisfy the above-described expression (1) based on Multiple-Key encryption. Further, ks1 is determined as a short number of digits that can be stored as a password by the user, and ks2 is a escrow key deposited in a private key escrow organization. M is an arbitrary plaintext block, C is the result of encrypting M, and (a mod b) is
This is the remainder of dividing a by b. X ′ is the deposit key ks
2 is RSA encrypted data with the escrow key ks2 itself,
X is data obtained by further encrypting X ′ with a common key encryption using a common key Skey generated based on a password. Function E represents a secret key encryption algorithm, and function D
Represents an inverse function of the function E.

FIG. 4 shows a specific example of the secret key escrow system according to the first embodiment of the present invention.

The node A (entity A) 200 and the private key depository (entity B) 300
00, and the user 600
From node 0, the node A200 is operated in order to have its escrow key safely delivered. Node A200 is the user 6
A password input receiving unit 201 that receives a password from 00 and a common key generating unit 202 that generates a common key Skey from the received password. 4, the same components as those in FIG. 3 are denoted by the same reference numerals, and description thereof will be omitted.

The operation of the configuration shown in FIG. 4 will be described below with reference to FIG.

In the configuration of FIG. 4, node A 200
When the password ks1 is received from the user 600 by the password input reception unit 201 (S101), the password ks1 is stored in the key storage unit 203 and is given to the common key generation unit 202 (S102).

The common key generation unit 202 generates a common key SKey for use in the common key encryption algorithm (S10).
3) Similarly, transfer to the key storage unit 203. For generation of the common key SKey in the common key generation unit 202, for example, an algorithm such as a one-way hash function that cannot easily find information before generation from a state after generation can be used.

As a representative one-way function, Ron Rivest
MD5 (RL Rivest, “The MD5 Mess
age Digest Algorithm ”, RFC 1321, Apr 1992).
An 8-bit hash value can be created.

Next, the node A 200 generates a request message for acquiring the escrow key by the escrow key acquisition request unit 204 in order to acquire the escrow key registered in the secret key escrow organization 300 in advance (S 104). , Network 500
The request message is transmitted via the server (S105). The request message includes the user name.

In the private key escrow organization 300, when the escrow key acquisition request receiving unit 305 receives the request message from the node A200, the escrow key storage unit (key management DB) 306 managed by the secret key escrow organization 300 The public key and the escrow key corresponding to the user name included in the request message are retrieved and retrieved (S106). Key management DB30
The public key kp and the protected escrow key X managed in 6 are registered in advance. The protected escrow key X is encrypted and protected by the following equation.

X ′ = ks2 ^ks2 mod n (2) X = E (Skey, X ′) (3) The public key of the user extracted from the key management DB 306 by the escrow key acquisition request receiving unit 305 and the protected escrow The key is
It is passed to the deposit key distribution unit 307. The escrow key delivery unit 307 creates a response message for delivering the escrow key protected by the node A200, and transmits it to the node A200 (S107). The response message contains the user's protected escrow key and public key.

In node A 200, escrow key accepting section 208
When the response message is received, the protected escrow key and the public key included in the response message are provided to the escrow key extracting unit 209 to extract the escrow key (S108). At the same time, the divided key k stored in the key storage unit 203
s1 and the common key SKey are given to the escrow key extracting unit 209.

The escrow key extraction unit 209 calculates the escrow key using the following formula (S109).

X '= D (Skey, X) (4)

(2) ^Deposited key ks2 = (X ′) ^ks1xkp mod n = ks2 ^ks2xks1xkp mod n (5) Here, in order to calculate a correct escrow key ks2, a division key ks1 given as a correct password by a user.
It is clear that the common key SKey is required.
The escrow key ks2 calculated in this way is divided key ks
1 is passed to the secret key synthesizing unit 210 for use as an RSA secret key. The secret key synthesizing unit 210 synthesizes the two split keys, ie, the split key ks1 given from the key storage unit 203 and the escrow key ks2 given from the escrow key extracting unit 209, and uses them as a secret key in RSA encryption (S110). In the case of encryption, the usage method is the formula (6)
In the case of decoding, it is expressed by equation (7).

C = M ^kp mod n (6) M = C ^{ks1xks2 node} n (7) Thus, the ^escrow key held by the private key ^escrow organization 300 is transmitted to the node A2 by the request from the user 600.
00, and the user 600 receives the first
Password and private key escrow organization 300
By using the second divided secret key, which is the escrow key distributed from, it is possible to perform authentication with another entity.

In storing and delivering the escrow key,
Encrypting the key so that it can be decrypted with a key decryption key such as a password known only to the user 600 allows the escrow key to be safely managed and delivered.

Further, the key decryption key for decrypting the protected escrow key may be a common key, a first divided secret key, or
By using both in combination, the escrow key can be safely delivered.

Next, a second key change in the present invention will be described.
An embodiment will be described. Here, the schematic configuration of a system to which the present invention is applied is the same as that shown in FIG.

FIG. 6 shows a configuration of a secret key escrow system according to the second embodiment of the present invention, and FIG. 7 shows an outline of a secret key escrow method in the second embodiment.

The entity A 200 shown in FIG. 6 includes a key dividing section 211 for dividing a secret key into a first divided secret key and a second divided secret key, a first divided secret key, and a key for storing a key decryption key. Storage unit 213, escrow key information acquisition request unit 2 for making a delivery request of escrow key information composed of the second divided secret key, prime number p and prime number q deposited in entity B300
14. Deposited key information receiving unit 218 for receiving the deposited key information from entity B300, and deposited key information receiving unit 218
Escrowed key information provided from the
The escrow key information extracting unit 219 that decodes the escrow key information from the key decryption key stored by 13 and extracts the second divided secret key, the prime number p and the prime number q. And a divided secret key generation unit 220 that generates a new second divided secret key.

The entity B 300 is the entity A
The escrow key information acquisition request receiving unit 315 that receives the escrow key information delivery request from the escrow unit 200 stores the escrow key information encrypted in advance with the encryption key,
Escrow key information storage unit 31 that returns protected escrow key information corresponding to entity A200 in response to a search request from 15
6 and a deposit key information delivery unit 317 that receives the protected deposit key information from the deposit key information acquisition request receiving unit 315 and delivers it to the entity A200.

First, in the entity A200, the RSA
Of the public and private keys of the user used in the encryption method,
The secret key is divided into two (S11), and one of the first divided secret keys is held (S12). The other second
Is deposited with the entity B300 (S1
3), the entity B300 holds this.

The secret key divided by the key dividing section 211 of the entity A 200 is a multiple-key encryption (CABoy
d, “Some Applications of Multiple Key Ciphers
”, Proceedings Eurocrypt 88, Springer-Verlag, 1
988)

## EQU3 ## The secret key satisfies the congruence of kp × ks1 × ks2≡1 (mod L) (1). Where ks
1 is the first split secret key, ks2 is the second split secret key, k
Let p be the public key. L is (p-1) and (q-
The least common multiple of 1), where p and q are any different large prime numbers, and in the following, n is the product of p and q.

The entity A 200 generates a second divided secret key obtained by dividing the secret key by the key dividing unit 211, a prime number p,
The escrow key information consisting of the prime number q is encrypted so that it can be decrypted with the key decryption key known only to the entity A, and is deposited in the escrow key information storage unit 316 of the entity B300. The encryption key for encrypting so that it can be decrypted with the key decryption key is, for example, DES encryption (FI
PS pub 46, “DataEncryption Standard”, NBS,
1977) and FEAL code (Miyaguchi, Shiraishi, Shimizu, "F
EAL-8 Encryption Algorithm ", Research Report, 37, 4/5,
pp. 321-327, 1988), a common key can be used as a common key based on a common key cryptosystem in which an encryption key and a decryption key are the same common key.
Can be used as an encryption key, and the first divided secret key and the public key can be used as a key decryption key.

Further, by combining the above two methods, the amount of calculation for decrypting the encrypted second divided secret key is increased, and the brute force attack of the key used for encryption is reduced. It can be difficult.

Next, the escrow key information obtaining unit 214 of the entity A 200 issues a request for obtaining escrow key information to the entity B 300 (S 14).

Thus, upon receiving the request, the escrow key information acquisition request accepting unit 315 of the entity B 300 receives the request from the escrow key information storage unit 316 and encrypts the escrow key with the encryption key. Search and retrieve information. Then, the entity B300 delivers the protected escrow key information from the escrow key information delivery unit 317 to the entity A200 (S15).

Next, in the entity A 200, the escrow key information delivered from the escrow key information delivery unit 317 is received by the escrow key information receiving unit 218 and transferred to the escrow key information extraction unit 219 to decrypt the escrow key information. I do.

The escrow key information extracting unit 219 decrypts the protected escrow key information using the key decryption key stored in the key storage unit 213, and extracts the escrow key information (S16). As a result, only the entity A200 that knows the correct key decryption key can obtain the escrow key information, synthesizes the first divided secret key and the second divided secret key, and creates one secret key ks
(S17).

Further, in the divided secret key generation unit 220, the prime numbers p and q of the escrow key information are

Ks1 ′ × ks2′≡ks (mod L) (8) A new first divided secret key ks1 ′ such that
By generating the second divided secret key ks2 ', each divided secret key can be changed without changing the public key (S18).

Next, a specific example of the secret key escrow system according to the second embodiment of the present invention will be described.

First, examples of variables and functions used in the following description will be described. kp is the user's RSA public key, ks1 and ks2 are the split keys of the user's RSA private key, and each of the keys kp, ks1, and ks2 is the Multip
It is determined so as to satisfy Equation (1) based on le-Key encryption. Further, ks1 is determined as a short number of digits that can be stored as a password by the user, and ks2, a prime number p,
The prime q is escrow key information to be deposited at a private key escrow organization. M is an arbitrary plaintext block, C is the result of encrypting M, and (a mod b) is the remainder of dividing a by b. X ″ is data obtained by performing RSA encryption on the escrow key information with the escrow key ks2 itself.

FIG. 8 shows a specific example of a secret key escrow system according to the second embodiment of the present invention.

In FIG. 8, node A corresponds to the above-described entity A200, and the private key depository corresponds to the above-described entity B300. 8, the same reference numerals are given to the same components as those in FIG. 6, and the description thereof will be omitted.

In the configuration shown in FIG. 8, node A 200
It comprises a password input receiving unit 212 for receiving a password from the user 600, a key storage unit 213, a deposit key information acquisition request unit 214, a deposit key information receiving unit 218, a deposit key information extracting unit 219, and a divided secret key generation unit 220. .

The secret key escrow system 300 includes a escrow key information acquisition request receiving unit 315, a escrow key information storage unit (a key management database) for storing a public key for each user name and escrow key information deposited from the user node. ) 316, escrow key information distribution unit 3
17.

The node A 200 and the secret key escrow system 3
00 is connected by a network 500.

The operation of the configuration shown in FIG. 8 will be described below.

When the password ks1 is received from the user 600 by the password input receiving unit 212, the node A200 holds the password ks1 in the key storage unit 213.

Next, the node A 200 obtains escrow key information registered in the secret key escrow organization 300 in advance.
A request message for acquiring escrow key information is created by the escrow key information acquisition
Send the request message via. It is assumed that the request message includes the user name.

In secret key escrow organization 300, upon receipt of the request message from node A 200 by escrow key information acquisition request receiving section 315, the request message is included in the request message from key management database 316 managed by secret key escrow organization 300. Search and retrieve the public key and escrow key information corresponding to the user name. The key management database 3
The public key kp and the protected escrow key information X ″ managed in 16 are registered in advance. The protected escrow key information X ″ is encrypted and protected by the following equation.

[0107]

X ″ = (ks2, p, q) ^ks2 mod n (9) The user's public key and protected ^escrow key information extracted from the key management database 316 by the ^escrow key information acquisition request receiving unit 315 are: Is transferred to the deposit key information delivery unit 317.

[0108] The escrow key information delivery unit 317 sends the information to the node A2.
A response message for delivering the escrow key information protected to 00 is created and transmitted to the node A200. The response message includes the user's protected escrow key information and the public key.

At node A200, escrow key information receiving unit 2
When the response message is received by 18, the protected escrow key information and the public key included in the response message are given to the escrow key information extraction unit 219 to extract the escrow key information.
At the same time, the divided key k stored in the key storage unit 213
s1 is given to the escrow key information extraction unit 219.

[0110] The escrow key information extraction unit 219 calculates escrow key information by the following formula.

[0111]

(Ks2, p, q) = (X ″) ^ks1xkp mod n = (ks2, p, q) ^ks2xks1xkp mod n (10) Here, in order to calculate correct ^escrow key information, It is clear that the divided key ks1 given as the correct password is necessary, and the escrow key ks2 in the calculated escrow key information is ks = ks1 × ks2 together with the divided key ks1. Can be used as the RSA secret key ks.

In the divided secret key generation section 220, the above-described equation (1) is obtained from the divided key ks1 given from the key storage section 213 and the escrow key ks2 given from the escrow key information extraction section 219, the prime number p and the prime number q. 8), the new split key ks1 ′
And a split key ks2 ′ can be generated.

After generation, a new split key ks1 ′ used as a password is notified to the user 600, and new deposit key information for depositing with the secret key deposit organization 300 is obtained in the same manner as in the above equation (9). It is calculated by the following equation (12).

[0114]

X ″ = (ks2 ′, p, q) ^{ks2 ′} mod n (12) According to the above series of procedures, the user's two divided secret keys can be changed at any time without changing the public key kp. It's clear what you can do.

In each of the above embodiments, the case where the secret key is divided into two has been described, but the secret key escrow method of the present invention is more generally applied to the case where the secret key is divided into a plurality. It is possible. That is, based on Multiple-Key encryption, a secret key that satisfies the congruence expressed by the following equation (13) is used,

.Times..times..times..times..times..times..times..times..times..times..tim- es..times..times..times..times..times..times..times..times..tim- es..times..times..times..times..times. Let kp be the public key.

In this case, the first divided secret key is held by the user, and the remaining (m-1) divided secret keys are deposited in (m-1) other entities.

The user's entity obtains ks = ks1 × ks2 ×... × ksm (14) from the split secret key requested and delivered to each of these entities and the first split secret key held by the user entity. By calculating, the RSA secret key ks can be obtained.

Also, as in the second embodiment, the prime numbers p and q used when generating the secret key are deposited with any of the other entities together with the remaining divided secret keys, and the user's From the secret key ks synthesized by the entity and the prime numbers p and q delivered together with the remaining divided secret keys from any of the other entities

(9) ks1 ′ × ks2 ′ ×... × ksm′９ks (mod L) (15)
By generating 2 ′,..., Ksm ′, each of the divided secret keys can be changed without changing the public key.

In this case, basically, the prime number p and the prime number q may be deposited in one of the other entities, but the prime number p and the prime number q may be deposited separately in another entity. .

Further, the number of new divided secret keys may be made different from the number of original divided secret keys, or the entity for depositing new divided secret keys may be changed or replaced to change the original divided secret keys. It may be deposited in an entity different from the key.

In the above embodiment, an example is shown in which the public key is obtained from another entity.
The present invention is not limited to this example, and may be stored in the key storage unit 213.

Further, the present invention is not limited to the above-described embodiment, but can be variously modified and applied within the scope of the claims.

[0123]

As described above, according to the secret key escrow method and system in the RSA cryptography of the present invention, the user's secret key used in the RSA cryptosystem is divided into two, and one of the two is divided into two. And obtain one of the divided secret keys from the private key escrow organization as necessary,
By combining with the other, only the correct user can acquire the secret key.

Further, by enciphering and depositing a divided secret key to be deposited at a private key depository with a common key, when a request to obtain the key is issued from a user entity, the deposit key By decrypting, only the entity that has the correct common key can obtain the escrow key.

Further, the divided private key to be deposited is encrypted by the divided private key itself, and a deposit key to be deposited at the private key depositor is generated and deposited. Without the divided private key (first divided secret key), the escrow key passed from the private key escrow organization cannot be decrypted.

In addition, by encrypting the encrypted escrow key with a common key known only to the user entity and escrowing it with a secret key escrow organization, a more strict security effect is achieved.

According to the present invention, the secret key of the user's public key and secret key used in the RSA
The first divided private key is held in the user entity and the other second divided secret key is deposited in another entity, so that the first It is only necessary to hold the divided secret key of the other. When necessary, the other second divided secret key is obtained from the other entity, and the two divided It is secure because there is no need to keep the private key in one place.

In addition, when a prime number p and a prime number q are further added to the second divided secret key deposited in another entity and the first divided secret key and the second divided secret key are changed, , Without changing the public key using the prime number p and the prime number q, the user's entity generates a new first divided secret key and a new second divided secret key independently, thereby changing the key. Management can be performed easily, and there is no need to change public keys in other entities.

According to the present invention, the RSA secret key is divided into a plurality of keys, one of which is held by the user,
Since the remaining divided private key is deposited in another entity, it is safe because the private key is divided into a plurality of pieces and stored. In addition, it becomes possible to use a password having a length as short as a human can store the divided secret key held by the user. From these, the following effects can be realized in the present invention.

(1) Location Free For a user, processing using the RSA encryption method can be performed not only by a specific local computer but also by any computer connected to a network.

(2) Device Free The user does not need to have any device for storing secret information. That is, the secret information for identifying the user can be provided based on the amount of information that can be stored by a human.

(3) Security Even if one of the divided secret keys is known to others, it cannot be used as an RSA secret key unless the remaining divided secret key is known, so that high security can be realized.

Further, it is possible to make only the authorized user who knows the secret information use the secret key.

Further, within the closed range to which the present invention is applied, the basis of the security can be clearly shown. For example, in a conventional method of storing a secret key in a file, although an RSA encryption algorithm is used to perform entity authentication, a different algorithm such as DES encryption is used to encrypt the secret key. As a result, it was not possible to clarify as to which algorithm the security depends on, but according to the present invention, it is possible to clearly show the security of the system to the user. is there.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a schematic configuration of a system to which the present invention is applied.

FIG. 2 is a sequence chart showing an outline of a secret key escrow method according to the first embodiment of the present invention.

FIG. 3 is a block diagram showing a configuration of a secret key escrow system according to the first embodiment of the present invention.

FIG. 4 is a block diagram showing a specific example of a secret key escrow system according to the first embodiment of the present invention.

FIG. 5 is a sequence chart showing an operation procedure in a specific example of the secret key escrow system of FIG. 4;

FIG. 6 is a block diagram showing a configuration of a secret key escrow system according to a second embodiment of the present invention.

FIG. 7 is a sequence chart showing an outline of a secret key escrow method according to the second embodiment of the present invention.

FIG. 8 is a block diagram showing a specific example of a secret key escrow system according to the second embodiment of the present invention.

[Explanation of symbols]

 Reference Signs List 200 Entity A (Node A) 201 Password input receiving unit 202 Common key generating unit 203, 213 Key storage unit 204 Escrow key acquisition request unit 205, 211 Key splitting unit 206 Key escrow unit 208 Escrow key accepting unit 209 Escrow key extracting unit 210 Secret key synthesizing unit 214 Escrowed key information acquisition requesting unit 218 Escrowed key information receiving unit 219 Escrowed key information extracting unit 220 Divided secret key generation unit 300 Entity B (private key escrow organization) 305 Escrowed key acquisition request receiving unit 306 Escrowed key storage unit (Key management DB) 307 Escrow key distribution unit 315 Escrow key information acquisition request receiving unit 316 Escrow key information distribution unit 317 Escrow key information storage unit (key management DB) 400 Other entity 500 Network 600 User

──────────────────────────────────────────────────の Continued on the front page (51) Int.Cl. ⁶ Identification code FI H04L 9/08 H04L 9/00 601Z 601A 601F (72) Inventor Tatsuaki Okamoto 3-19-2 Nishishinjuku, Shinjuku-ku, Tokyo Japan Telegraph and Telephone Corporation

Claims (30)

[Claims] 1. A secret key of a user's public key and secret key used in the RSA encryption method is divided into two by a user entity, and a first divided secret key of the divided secret keys is The second divided secret key of the divided secret keys held in the user entity is deposited from the user entity to another entity, and in response to a request from the user entity, Delivering the second split secret key from the entity to the user entity, and the first split secret key held by the user entity and the second split delivered from the other entity. RSA characterized in that a secret key is synthesized to obtain a secret key to be used for processing by the RSA encryption method.
Private key escrow method in cryptography. 2. The user entity encrypts the second divided secret key with an encryption key so that the second divided secret key can be decrypted with a key decryption key known only to the user entity,
Depositing an encrypted second divided secret key with the other entity, wherein the other entity uses the encrypted second divided secret key in response to a request from the user entity; 2. The user entity, wherein the user entity obtains the second divided secret key by decrypting the encrypted second divided secret key with the key decryption key. RSA described
Private key escrow method in cryptography. 3. The encryption key and the key decryption key,
3. The method according to claim 2, wherein the common key is a common key generated by a user entity. 4. The secret in the RSA encryption according to claim 3, wherein the common key is a hash value obtained by the one-way hash function from the first divided secret key in the user entity. Key escrow method. 5. The method according to claim 1, wherein the encryption key is the second divided secret key itself, and the key decryption key is composed of the first divided secret key and the public key. 3. The secret key escrow method in the RSA encryption according to claim 2. 6. The other entity holds the second divided secret key together with the public key, and in response to a request from the user entity, stores the public key together with the second divided secret key. Delivering to a user entity, wherein the user entity uses the held first divided secret key and the public key delivered from the other entity as the key decryption key. Item 6. The secret key escrow method in RSA encryption according to Item 5. 7. The user entity encrypts the second split secret key with the second split secret key itself,
Further, the encrypted second divided secret key is encrypted with a common key that can be known only to the user entity to obtain an escrow key, and the escrow key is escrowed with the other entity. Delivering the escrow key to the user entity in response to a request from the user entity, the user entity decrypting the escrow key with the common key and encrypting the encrypted second divided secret key 2. The RSA according to claim 1, wherein the second divided secret key is obtained by decrypting the encrypted second divided secret key with the first divided secret key and the public key. Private key escrow method in cryptography. 8. The secret key in the RSA encryption according to claim 7, wherein the common key is a hash value obtained by the one-way hash function from the first divided secret key in the user entity. Deposit method. 9. The other entity holds the second divided secret key together with the public key, and uses the public key together with the second divided secret key in response to a request from a user entity. And the user entity decrypts the encrypted second divided secret key using the held first divided secret key and the public key distributed from the other entity. 8. The secret key escrow method in RSA encryption according to claim 7, wherein 10. The RS according to claim 1, wherein the first divided secret key is held in the user entity as a password stored by the user.
Secret key escrow method in A-encryption. 11. The user entity, wherein when the password is input by the user, the user entity requests the other entity to deliver the second divided secret key. Item 10. The secret key escrow method in the RSA encryption according to Item 10. 12. The user entity requests the other entity to deliver the second divided secret key to the other entity when the user performs a process according to the RSA encryption method. The secret key escrow method in the RSA encryption according to claim 1. 13. The prime number p and the prime number q used at the time of generation of the secret key are also deposited with the other entity together with the second divided secret key, and the other entity receives a request from the user entity. Distributes the prime number p and the prime number q to the user entity together with the second divided secret key, wherein the user entity transmits the first divided secret key and the second divided secret key The secret key obtained by combining
Using the prime numbers p and q delivered from the other entity, a new first divided secret key and a second divided secret key different from the first divided secret key and the second divided secret key 2. The secret key escrow method in the RSA encryption according to claim 1, wherein the public key is generated without changing the public key. 14. The user's public key and secret key used in the RSA encryption method, the secret key is divided into a plurality of pieces by a user entity, and one of the divided secret keys is used for the secret key. Each of the remaining divided private keys among the divided private keys is stored in the user entity and deposited in another entity different from the user entity, and in response to a request from the user entity, Delivering the remaining split secret key from each of the other entities to the user entity, wherein the one split secret key held at the user entity and the remaining splits delivered from the other entity; RSA characterized in that a secret key is synthesized to obtain a secret key to be used for processing by the RSA encryption method.
Private key escrow method in cryptography. 15. The prime numbers p and q used in generating the secret key together with the remaining divided secret keys are deposited with one of the other entities, and any of the other entities is used for the usage. In response to a request from a user entity, the prime number p and the prime number q are delivered to the user entity together with the remaining divided secret key, and the user entity transmits the one divided secret key and the remaining divided secret key. The secret key obtained by combining
Using the prime p and the prime q delivered from any of the other entities to change the public key to a new plurality of divided secret keys different from the one divided secret key and the remaining divided secret keys. The secret key escrow method in the RSA encryption according to claim 14, wherein the secret key is generated without using the key. 16. A secret key escrow system in RSA cryptography comprising a user entity and another entity, wherein the user entity is a secret key of a user's public key and secret key used in the RSA cryptosystem. Key dividing means for dividing the secret key into two, and exchanging the remaining second divided secret key excluding the first divided secret key held in the user entity among the divided secret keys with another entity Key escrow means for escrow, split secret key acquisition means for requesting the other entity to deliver the second split secret key, and receiving the delivered second split secret key, held in the user entity Said first
Secret key synthesizing means for synthesizing the divided secret key of the above and the second divided secret key delivered from the other entity to obtain a secret key to be used for processing by the RSA encryption method. Secret key escrow system in cryptography. 17. The key escrow means encrypts the second divided secret key with an encryption key so that it can be decrypted with a key decryption key known only to the user entity. Depositing the split secret key with the other entity, the other entity delivering the encrypted second split secret key to the user entity in response to a request from the user entity, 17. The secret according to claim 16, wherein the secret key synthesizing means obtains the second divided secret key by decrypting the encrypted second divided secret key with the key decryption key. Key escrow system. 18. The private key escrow system in the RSA encryption according to claim 17, wherein the encryption key and the key decryption key are common keys generated in the user entity. 19. The secret according to claim 18, wherein the common key is a hash value obtained by the one-way hash function from the first divided secret key in the user entity. Key escrow system. 20. The method according to claim 20, wherein the encryption key is the second divided secret key itself, and the key decryption key is composed of the first divided secret key and the public key. The secret key escrow system in the RSA encryption according to claim 17. 21. The other entity holds the second divided secret key together with the public key, and in response to a request from the user entity, stores the public key together with the second divided secret key. Delivered to a user entity, the secret key synthesizing means uses the first divided secret key held in the user entity and the public key delivered from the other entity as the key decryption key 21. The secret key escrow system in RSA encryption according to claim 20, wherein 22. The key escrow means encrypts the second divided secret key with the second divided secret key itself, and further encrypts the second divided secret key so that only the user entity can know the second divided secret key. A escrow key is obtained by encrypting with a common key, the escrow key is escrowed to the other entity, and the other entity distributes the escrow key to the user entity in response to a request from the user entity. The secret key synthesizing unit decrypts the escrow key with the common key to obtain the encrypted second divided secret key, and converts the encrypted second divided secret key into the first divided secret key. 17. The secret key escrow system in the RSA encryption according to claim 16, wherein the second divided secret key is obtained by decrypting with the divided secret key and the public key. 23. The secret key according to claim 22, wherein the common key is a hash value obtained by the user entity from the first divided secret key using a one-way hash function. Deposit system. 24. The other entity holds the second divided secret key together with the public key, and in response to a request from the user entity, stores the public key together with the second divided secret key. Delivering to the user entity, the secret key synthesizing means, the second divided private key held by the user entity and the encrypted second public key delivered from the other entity. 23. The secret key escrow system in the RSA encryption according to claim 22, wherein the secret key is decrypted. 25. The R according to claim 16, wherein the first divided secret key is held in the user entity as a password stored by the user.
Secret key escrow system in SA encryption. 26. The split secret key obtaining means, when the password is input by the user, requests the other entity to deliver the second split secret key. 26. The secret key escrow system in RSA encryption according to claim 25. 27. The divided secret key acquisition means requests the other entity to deliver the second divided secret key to the other entity when the user performs a process using the RSA encryption method. 17. The secret key escrow system in RSA encryption according to claim 16. 28. The key escrow means, together with the second divided secret key, a prime p used when the secret key is generated,
The prime number q is also deposited with the other entity, and the other entity delivers the prime number p and the prime number q to the user entity together with the second divided secret key in response to a request from the user entity. The secret key synthesizing means uses the secret key obtained by synthesizing a first split secret key and the second split secret key, and the prime numbers p and q distributed from the other entity. And generating a new first divided secret key and a second divided secret key different from the first divided secret key and the second divided secret key without changing the public key. The secret key escrow system in the RSA encryption according to claim 16. 29. A secret key escrow system in RSA cryptography comprising a user entity and another entity, wherein the user entity is a secret key of a user's public key and secret key used in the RSA cryptosystem. A private key dividing means for dividing the private key into a plurality of sub-keys, and depositing each of the remaining divided private keys other than one divided private key held in the user entity among the divided private keys into another different entity Key escrow means, requesting each of the other entities to deliver the remaining split secret key, and receiving the delivered remaining split secret key, split secret key obtaining means, and held by the user entity And combining the one divided secret key and the remaining divided secret key delivered from the other entity for processing by RSA encryption. Private key escrow system in RSA cryptography, characterized by having a secret key combining means for obtaining a secret key that. 30. The key escrow means, together with the remaining divided secret key, a prime p used when generating the secret key,
The prime q is also deposited with any of the other entities, and any of the other entities, upon request from the user entity, is used to store the prime p and the prime q together with the remaining divided secret key in the user entity. The secret key synthesizing means, the secret key obtained by synthesizing the one split secret key and the remaining split secret key, and the prime p delivered from any of the other entities, 30. The RSA according to claim 29, wherein a new plurality of divided secret keys different from the one divided secret key and the remaining divided secret keys are generated without changing the public key using a prime number q. Secret key escrow system in cryptography.