KR100198810B1 - Multi-signature method and modular value generation method - Google Patents

Abstract

The present invention uses the RSA (Rivest Shamir Adleman) public key cryptosystem (multisignature), that is, when multiple users sign a single message, the RSA modular value of each user The present invention relates to a method for solving a block protection problem inevitably caused by a difference in size of RSA. RSA is required for an RSA multi-signature process in which all users have the same length and use the same RS modular value with the highest 1-bit type. We propose a method of generating modular values and multiple signing using these RSA modular values.

The RSA public key cryptosystem is a public key cryptosystem based on the difficulty of factoring problems and is applicable to digital signatures. However, if several people want to multi-sign a single document, a block protection problem is caused by the difference in RSA modular values of each user. The block protection problem here occurs when another signer wants to sign an RSA signature generated by an arbitrary signer, and the pre-generated RSA signature is larger than another signer's RSA modular value. Will fail even if done correctly. To solve this block protection problem, we propose a method that all users of the RSA public key cryptosystem have the same length and the most significant 1-bit type has the same RSA modular value. In such a system, users can multi-sign and solve the block protection problem with a high probability. However, in this case, an RSA modular value is essentially required, which is a product of two prime numbers having a certain length and having a certain constant and a large prime number. Here, having a large prime factor is one of the prerequisites for the RSA public key cryptosystem to be secure. According to the present invention, an RSA modular value satisfying these characteristics can be generated. Thus, it is possible to actually implement an RSA multi-signature method in which all users have the same length and the same RSA modular value with the highest 1-bit form, and ultimately all users have a certain length, the same one with the highest 1-bit form, and a large prime factor. It is possible to implement a practical implementation of the RSA public key cryptosystem with RSA modular value that is the product of two prime numbers.

Description

Multiple signature method and suitable modular value generation method

The present invention relates to a multiple signing method and a method for generating a modular value suitable for the same, and particularly, a block protection inevitably generated when a plurality of people multi-sign a single message by using a RSA (Rivest Shamir Adleman) public key cryptosystem. The present invention relates to a multi-signature method and a method for generating modular values suitable for solving the problem.

In general, a public key cryptosystem is disclosed by registering each user U _i with a public key (E _ui ) in a public key directory 11, as shown in FIG. It is composed. That is, the public key directory 11 stores the public key E _1i of each user of the public key cryptosystem. In addition, each user securely stores a secret key (D _ui ) corresponding to his public key (E _ui ).

Therefore, each user digitally signs the message using his _private key (D _ui ), which he keeps safe when digitally signing, and sends it to the recipient, and the recipient sends the sender's public key (E _ui ) stored in the public key directory. To verify the signature. Then, the digital signature procedure using the public key cryptography system will be described with reference to FIG.

Proceeding from the start step to step 21, the sender U _i first generates a message to be signed. Proceed to step 22 to generate a signature (S _i ) for the message to be signed using its _private key (D _ui ), and then proceed to step 23 to receive the message and signature (S _i ) Send to (U _j ). Subsequently, in step 24, the receiver U _j decrypts the received signature using the public key E _ui of the sender U _i registered in the public key directory, and then proceeds to step 25 to confirm signature verification. Perform. At this time, if the result obtained by the decryption is the same as the message sent by the sender U _i with the signature, the receiver U _j checks the signature and terminates. If not, proceeds to step 26 and receives the received message. Reject or request retransmission from the sender U _i . Next, a configuration procedure of the RSA public key cryptosystem will be described with reference to FIG. 3.

In order to configure the RSA public key cryptosystem, the user U _i first proceeds from the start step to step 31 to generate two prime numbers P _i and Q _i and then proceeds to step 32 to calculate N _i . N _i is calculated by multiplying the two prime numbers P _i and Q _i as in Equation 1 below. Proceed to step 33, where (P _i -1) X (Q _i -1) and an integer D _i mutually different are selected. Proceed to step 34 to calculate the inverse Ei of the multiplication of Di for the modular (P _i -1) X (Q _i -1), and then proceed to step 35 to set the RSA public key E _ui = Register (E _i , N _i ) in the public key directory and proceed to step 36 to securely store the RSA beta key D _ui = (P _i , Q _i , N _i ).

In other words, when the digital signature procedure using the RSA public key cryptosystem based on FIG. 2 and FIG. 3 is described, the sender U _i generates a message M to be signed. The sender U _i generates a signature S _i for the message M using its private key D _i as shown in Equation 2 below.

The M and S _i are transmitted to the receiver U _j . And the public key of the sender from the M U _i and the receiver receiving the S _i U _j is the sender of the U _i registered in the public key directory, Decode the signature S _i using the same procedure as in Equation 3 below.

When the M is correctly obtained in the decoding process, the receiver U _j determines that the signature is correct, and when the baby M is not correct, the receiver U _j rejects the reception or requests retransmission.

When a plurality of users want to sign one document, that is, multiple signatures using the RSA public key cryptosystem, a block protection problem occurs.

For example, users U ₁ and U ₂ sign a message M, where each RSA public key is (E ₁ , N ₁ ) and (E ₂ , N ₂ ) and the RSA private key is (D ₁ , P ₁ , Q ₁ ) and (D ₂ , P ₂ , Q ₂ ) and if N ₁ ≤ N ₂ , firstly, when the user U ₁ signs first and then the user U ₂ signs, the user U ₁ If the result of signing this message M is S ₁ , then S ₁ = M ^D1 Mod N ₁ . If the user U ₂ signs the signature result S ₁ of the user U ₁ using his RSA secret key D ₂ , the result S ₂ = S ₁ ^D1 Mod N ₂ = (M ^D1 Mod N ₁ ) ^D2 Mod N ₂ is obtained.

Second, when the user U ₂ signs first, S ₁ = M ^D2 Mod N ₂ . After the user U ₁ signs, since N ₁ ≤ N ₂ , a probability S ₁ ≥ N ₁ occurs. In this case, the signature of the user U ₁ for S ₁ is determined by S'≡S ₁ Mod N ₁ . Will be identical to the signature for. Thus, different signatures can be generated according to the signature order of the signing user. This is called a block protection problem. The block protection problem occurs even when multiple signatures have different sizes of RSA modular values N _i between each user.

Therefore, in order to solve this problem, a multiple signature method using various RSA public key cryptosystems has been proposed. Among them, there is a method that does not cause bit expansion, which is to sign the user having the smallest RSA modular value among the users participating in the signature. However, when using this method, the order of signatures is limited according to the RSA modular value, and a new user cannot participate in a signature during multiple signatures. Alternatively, all users participating in multiple signatures can use a particular type of RSA modular value to minimize the probability of block protection problems.

Accordingly, the present invention provides a multi-signature method and a modular value generation method suitable for solving the above-mentioned disadvantages by multi-signing using RSA modular values having the same length and having the same upper 1-bit form. The purpose is.

In order to achieve the above object, a multi-signature method according to the present invention includes a first step of selecting a first signer from a start step and receiving a secret key and a modular value N ₁ of a first signer, and a message from the first step. A second step of generating a signature for the second step; a third step of comparing the magnitude of the signature and H from the second step; and if the signature from the third step is greater than the H, the first signer A fourth step of repeating an exponential operation until the signature is smaller than H, a fifth step of checking the order of the signers when the signature is smaller than H from the third step, and the fifth step The sixth step of transmitting the signature from the sixth signer to the second signer, and the user receiving the multiple signatures for the message after comparing the order of the signers from the sixth step, A seventh step of performing a decryption process using the public key of the third party; an eighth step of comparing the magnitude of the signature calculated from the seventh step with H; and a signature if the signature is larger than H from the eighth step. The ninth step of repeating the exponential operation until it is smaller than H, and after receiving and confirming the last signature from the ninth step, if the message is correct, proceeds to stop and if the message is not correct, rejects or resends The modular value generation method suitable for the multi-signature method according to the present invention is characterized in that it comprises a tenth step that requires a number of two prime numbers of which all users have a specific length, have the same top 1-bit form, and have a large prime factor. It is characterized by consisting of a product.

1 is a configuration diagram illustrating a general public key cryptosystem.

2 is a flowchart illustrating a digital signature procedure using a public key cryptosystem.

3 is a flowchart illustrating a configuration procedure of an RSA public key cryptosystem.

4 is a flow chart illustrating a multiple signing procedure of an RSA public key cryptosystem where all users have the same length and the same highest order one bit type uses the same RSA modular value.

FIG. 5 is a flow chart illustrating an RSA modular value generation procedure of a product of two prime numbers of a particular length and with a particular upper one bit form and a large prime factor.

Hereinafter, with reference to the accompanying drawings will be described in detail the present invention.

4 is a flowchart illustrating a multiple signing procedure of an RSA public key cryptosystem where all users have the same length and the same 1-bit form of RSA modular value. Are called signers participating in multiple signatures, Let be the RSA modular value of each of the above signers. The RSA modular values of the signers all have a length of K bits and assume that the most significant 1 bit type is the same. Then, the RSA modular value N _i of each user may be expressed as in Equation 4 below.

Let CX2 ^K-1 be the reference value H. And E _i and N _i are the RSA public key of signer U ₁ , and D _i , P _i and Q _i are the RSA private key of signer U _i . Then in this case the signer The process of generating multiple signatures for plaintext M < N ₁ will be described.

First, proceeding from the start step to step 400 to select the first signer, and proceeds to step 401 to enter their private key D ₁ and its own modular value N ₁ . Subsequently, proceeding to step 402, U ₁ generates a signature S ₁ for the message M as shown in Equation 5 below.

Next, the process proceeds from step 403 to confirm the S ₁ and if S ₁ ≥ H proceeds to step 404 until the first signer U ₁ becomes smaller than H ₁ . S ₁ = S ₁ ^D1 Mod N ₁ is calculated repeatedly. When S ₁ becomes smaller than H, the S ₁ is transmitted to the second signer U ₂ . Subsequently, the i th signer U _i calculates S _i = S _i-1 ^Di Mod N _i for the signature S _i-1 received from the i-1 th signer U _i-1 (step 402). Next, a check is performed on S _i (step 403). If the S _i ≥ H i-th signer U _i is calculated by S _i is repeated for ^{_{S i = S i-1 Di}} Mod N i until becomes smaller than H (step 404). And S _i is less than H when transmits the S _i to (i + 1) th signer U _{i + 1.} Signing the result of the last signatory U _m S _m is a multiple signature for the message M. The user who receives the multiple signature S _m for the message M _Calculate S _j-1 = S _j ^Ej Mod N _j using the signer's public key with respect to (step 409). Next, in this case, as in the case of signature, the verification process for S _j-1 is performed (410). If S _j-1 is greater than H, S _j-1 is repeatedly calculated until S _i-1 is less than H (step 411). Finally, the user who receives S _m checks whether S ₀ and M are the same (step 414).

The probability that S _i-1 ^Di Mod N _i 〈H at signing is greater than 1-2 ^{−1 +1} . Therefore, if 1 = 32 or more, there is little chance that each signer will repeatedly perform exponential operations with its private key. Therefore, the total number of exponential power operations performed by each signer until the signature S _m is generated is less than the average (1 + 2 ^{-1 + 1} ) m. Similarly, the receiver receiving the final S _m can be verified with only an average (1 + 2 ^{-1 + 1} ) · m exponential operation. This method is very effective because each signer actually performs only one exponential operation. For example, if 1 = 32 and M = 20, the number of exponential calculations required in this method is average (1 + 2 ^-31 ) x 20. In this case, 2 ^-31 can be ignored, so it can be said that it performs about 20 exponential power operations. In conclusion, the multiple signing method using the RSA public key cryptosystem shown in FIG. 4 is a very efficient method.

FIG. 5 is a flowchart for explaining a procedure of generating an RSA modular value, which is a product of two prime numbers having a specific length, the same upper 1 bit form, and having a large prime factor. It is a condition for use in the RSA multi-signature method shown in FIG. 4, and having a large prime factor is to ensure the fundamental security of the RSA public key cryptosystem. First, all users of the RSA public key cryptosystem agree to randomly generate the bit length K and the 1-bit form C of the RSA modular value to use. That is, the RSA modular value N of each user should have a bit length K and the most significant 1 bit type C. Also, for the security of the RSA cipher, N must be a product of two prime numbers with large prime factors. First, the user Ui generates a K-1 bit random number R (step 501) to calculate N = C · 2 ^K-1 + R (step 502). Next, generate a K / 2-bit P generates a random number (step 503), K / 2-1-t-bit prime number P _'i and Q' _i (step 504). And the following formula 6 is calculated.

And Pi = 2 · P '_iCalculate S + 1 (step 506) to the P_iCheck if is a prime number (step 507). If this is not a prime number, S = S + 1 (step 509) and returns to step 506 above. Also said P_iQ is primeN / P_i (Step 508) and then S = Q / (2Q '_i(Step 510). Next Q_i= 2 · Q '_iCalculate S + 1 (step 511) and Q_iCheck if is a prime number (step 512). Where Q_iIf is not a prime number, S = S +1 (step 513) and the process is executed again from step 511 above. If Qi is a prime number, Ni = PiiQi is calculated (step 514). to the nextN_i/ 2^k-1 = Check that C holds (step 515). If not, return to step 501 and if established, N obtained in step 54_iIs an RSA modular value with a K bit length and the upper 1 bit type C. N generated through the above process_iThe upper 1 bit forms of are all the same as C, but N_iPrime factors of_iAnd Q_iHave a random bit form. The t value in step 504 is the RSA modular value N for the S value that is increased in steps 509 and 513._iThis variable is set so that the most significant 1-bit type C of C is not changed. In practice, when t = 16, the RSA modular value N generated in step 514 is used._iThe upper 1 bit of C is almost always C. P ′ generated in step 504_i, Q '_iP_i ^-OneAnd Q_i ^-OnePrime (K / 2) -1-t bit prime, so prime P_i, Q_iAre prime numbers with large prime factors. Prime P generated in the same way as in FIG._i, Q_iAnd the compound number N_iIs a K-768, l = 32, and t = 16, all of your RSA modular values are 768 bits long, and the upper 32 bits are C = LN._i/2⁷³⁶Same as 2⁷⁶⁷〈N_i< 2⁷⁶⁸to be. Each prime P_i, Q_iIs 384 bits, P_i ^-One, Q_i ^-OneAre prime factors P 'each 336 bits long_i, Q '_iHas

As described above, according to the present invention, when the digital signature using the RSA public key cryptosystem is generated by substantially generating an RSA modular value consisting of a product of two prime numbers having a specific length and the same top 1 bit form and having a large prime factor. The block protection problem is effectively solved, resulting in multiple signatures using an efficient RSA public key cryptosystem. In addition, there is an effect that the actual implementation of the RSA public key cryptosystem having an RSA modular value, which is a product of two prime numbers, in which all users have the same length and most significant one bit type and has a large prime factor.

Claims (4)

A first step of selecting a first signer from a start step and receiving a private key and a modular value N1, a second step of generating a signature for a message from the first step, and the signature and H from the second step A third step of comparing the magnitude of the first step, and if the signature is greater than or equal to H from the third step, the first signer repeats an exponential operation until the signature is smaller than the H; A fifth step of confirming the order of the signers when the signature is smaller than H from the third step, a sixth step of transmitting the signature to the second signer from the fifth step, and a signing of the signer from the sixth step. After comparing the order, the user who has received the multi-signature for the message performs the decryption process by using the signer's public key, and the document calculated from the seventh step. An eighth step of comparing the magnitudes of the names and H; a ninth step of repeating the exponential power operation until the signature becomes smaller than H if the signature is larger than H from the eighth step; 10. The multi-signature method of claim 10, wherein the message is terminated if the message is correct after receiving and confirming the signature, and if the message is not correct, the tenth step of rejecting the reception or requesting retransmission. The method of claim 1, wherein the modular value used is the same length for all users, the most significant one bit pattern is the same, and the product of two prime numbers with large prime factors. The multi-signature method of claim 1, wherein the third and eighth steps and H confirm whether exponential multiplication is performed using a reference value of H = C × 2 ^K−1 . A modular value generation method suitable for a multiple signature method, wherein all users have a specific length and have two products having the same first-bit form and having a large prime factor.