KR102019558B1 - Efficient signature verification method for digital signatures using implicit certificates - Google Patents

Abstract

Efficient signature verification methods for digital signatures using implicit certificates are improved. According to one or more exemplary embodiments, a signature verification method includes: receiving an electronic certificate based on a message to which an electronic signature transmitted from a sender is added; Extracting reconfiguration information conventionally used to reconstruct a public key from the implicit certificate in accordance with an implicit certificate as the electronic certificate; And performing signature verification on the electronic signature using the reconstruction information extracted from the implicit certificate.

Description

Effective signature verification method for digital signatures using implicit certificates {EFFICIENT SIGNATURE VERIFICATION METHOD FOR DIGITAL SIGNATURES USING IMPLICIT CERTIFICATES}

The description below relates to a method and system for efficiently verifying a signature in a protocol that uses an implicit certificate.

Since messages can be forged or tampered with by malicious attackers on network communications, the integrity and authenticity of the messages in the communication protocols must be guaranteed. To solve this, the message sender must send the message and the digital signature together, and the receiver must be able to verify that the digital signature is valid.

1 is a view for explaining a signature verification process. These digital signatures are based on public key cryptography, which is based on a very difficult mathematical problem to solve, and involves the use of certain kinds of secrets (public keys) and public information derived from secrets (public keys). Use key pairs. Each of the clients (sender and recipient) 110, 120 may each have a certificate from a certificate authority that they trust. In this case, the clients 110 and 120 may be fixed terminals or mobile terminals implemented as computer devices. Examples of the clients 110 and 120 include a smart phone, a mobile phone, a navigation device, a computer, a notebook computer, a digital broadcasting terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), a tablet PC, and the like. Can be. It may also be a server for transmitting a message to which an electronic signature has been added.

The sender 110 may generate an electronic signature for the message using the sender's private key and then transmit the message to which the electronic signature is added to the receiver 120. The receiver 120 receives a message with an electronic signature from the sender 110. The recipient 120 can verify the electronic signature of the message using the sender's public key. In general, the public key of the sender 110 is provided with an electronic certificate for verifying the validity of the public key. Certificate Authority (CA) 100 means a trusted authority that issues digital certificates. The digital certificate may be configured in a form in which the sender's public key information and related additional information are validated and a digital signature is added by the certification authority 100 to the message.

Accordingly, when the authenticity of the certification authority 100 that issued the electronic certificate to the sender is not verified, that is, when the receiver 120 does not know the public key of the certification authority 100, the electronic signature of the certification authority 100 is determined. Because of the difficulty of verifying this, it is necessary to construct a chain of trust chain in which a higher certification authority (CA ') issues a digital certificate for the public key of the certification authority (CA). In the middle or at the end of the chain there may be an electronic signature of a certificate authority whose recipient has a public key, which is then validated in the reverse direction so that the sender's public key can be verified. For example, referring to FIG. 2, CA _1, which issued the digital certificate to the sender, is issued a certificate from CA ₂ , which is a higher certification authority, CA ₂ is issued a certificate from CA ₃ , and this scheme is applied to the root certificate authority. Connected. Indeed, digital certificates exist in the form of chains in which several certificates are linked.

On the other hand, in a special network communication environment, the communication bandwidth may be extremely limited. For this purpose, inherent certificates may be used in place of the existing explicit certificates including the sender's public key and the signature of the certificate authority. . In this case, the certificate is not a combination of the public key and the signature, that is, a combination of the two pieces of information, but the certificate itself. The recipient extracts the sender's public key from it. This saves bandwidth usage. For example, the IEEE 1609.2 automotive communication standard Wireless Access in Vehicular Environments (WAVE) uses the Elliptic Curve Digital Signature Algorithm (ECDSA) as an electronic signature algorithm and the Elliptic Curve Qu-Vanstone (ECQV) implicit certificate as a type of certificate.

The present invention can provide a method for efficiently verifying a sender's signature in a communication protocol using an implicit certificate.

The signature verification method includes receiving an electronic certificate based on a message with an electronic signature sent from a sender; Extracting reconfiguration information used to reconstruct the sender's public key from the implicit certificate as an implicit certificate is used as the electronic certificate; And performing signature verification on the electronic signature using the reconstruction information extracted from the implicit certificate.

Extracting reconstruction information used to reconstruct the sender's public key from the implicit certificate may include: a hash value of the implicit certificate and the public key reconstruction information encoded in the implicit certificate and the certificate authority that issued the implicit certificate. The method may include extracting a public key of.

Extracting reconfiguration information used to reconstruct the sender's public key from the implicit certificate may include: recognizing, if the public key of the certificate authority is not identified, the certificate authority issued from a certificate authority higher than the certificate authority. And extracting the hash value of the implicit certificate for the implicit certificate and the public key reconfiguration information encoded in the implicit certificate and the public key of the higher certification authority that issued the certificate of the certificate authority.

The step of performing signature verification on the digital signature using the reconstruction information extracted from the implicit certificate may include applying a batch signature verification method to shorten the time for verifying signatures upon receiving the electronic signature from a plurality of senders. It may include a step.

Performing signature verification for the digital signature using the reconfiguration information extracted from the implicit certificate may include: resharing the same certificate authorities associated with each digital signature as receiving a digital signature from a plurality of senders; And extracting the same reconstruction information among reconstruction information used for reconstructing the public key of the previous caller extracted in the process of extracting the information.

-좌표, 상기 전자 서명이 부가될 메시지의 해시값 및 상기 발신자의 개인키를 이용하여 생성된 제1 서명쌍을 사용하여 상기 임시점을 재구성함에 따라 획득된 재구성점의

-좌표를 비교하거나, 상기 제1 서명쌍 대신 상기 임시점이 포함된 제2 서명쌍을 사용하여 상기 재구성점과 상기 임시점을 비교하는 단계를 포함할 수 있다. Performing signature verification on the digital signature by using the reconstruction information extracted from the implicit certificate, the temporary point obtained by generating the digital signature.

A reconstruction point obtained by reconstructing the temporary point using a coordinate, a hash value of the message to which the digital signature is to be attached, and a first signature pair generated using the sender's private key.

Comparing coordinates or comparing the reconstruction point with the temporary point using a second signature pair including the temporary point instead of the first signature pair.

The signature verification system includes: a receiving unit which receives an electronic certificate based on a message with an electronic signature transmitted from a sender; An extraction unit for extracting reconfiguration information used to reconstruct the sender's public key from the implicit certificate; And an execution unit that performs signature verification on the electronic signature by using reconstruction information extracted from the implicit certificate.

In the present invention, when verifying signatures received from a plurality of senders, the overall computation amount can be reduced by including a process of extracting a public key from a plurality of senders' intrinsic certificates in the process of performing signature verification.

In the present invention, since the hash value of the implicit certificate received from the same certificate authority and the public key reconstruction information encoded in the implicit certificate are the same, the public key reconstruction information is added to the same terms to reduce the amount of computation as the signature is verified. This can reduce the time required for the whole process.

1 is a view for explaining a signature verification process.
2 is a view for explaining the configuration of a chain of trust chain of the certification authority.
3 is a diagram for describing a method of reducing an operation amount of signature verification by sharing an implicit certificate through a certificate tree according to an embodiment.
4 is a block diagram illustrating a configuration of a signature verification system according to an exemplary embodiment.
5 is a flowchart illustrating a signature verification process in a signature verification system according to an exemplary embodiment.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings.

In the following embodiment, a process for efficiently verifying multiple signatures in a protocol using an implicit certificate will be described. The prior art must first know the public key of the digital signature sender in order to perform verification of the digital signature. In the conventional protocol using an explicit certificate, the public key of the sender included in the certificate is used, whereas in the protocol using the implicit certificate, the hash value of the certificate, reconfiguration information in the certificate, and the public key of the certificate authority that issued the certificate. Sender's public key can be extracted and used.

)의 내재적 인증서로부터 인증서의 해시값(

) 및 인증서에 인코딩되어 있는 공개키 재구성 정보(

)를 추출하고, 인증 기관(CA)의 공개키(

)를 사용하여 발신자의 공개키를 아래와 같은 식에 기초하여 추출할 수 있다.For example, using Certicom's ECQV implicit certificate, the public key of the digital signature sender can be extracted from the implicit certificate. Caller(

Hash value of the certificate from the implicit certificate of

) And public key reconfiguration information encoded in the certificate (

), And the public key (

), The sender's public key can be extracted based on the following equation.

Equation 1:

)를 알고 있지 않을 경우, 상기 인증 기관보다 상위의 인증 기관이 발급한 인증 기관의 내재적 인증서로부터 인증 기관의 공개키를 추출하는 과정이 추가로 필요하며, 이를 재귀적으로 적용할 수 있다. At this time, the public key of the certification authority (

If you do not know), the process of extracting the public key of the certification authority from the intrinsic certificate of the certification authority issued by the certification authority higher than the certification authority is further required, and this can be applied recursively.

)를 알고 있다면, 발신자의 공개키는 아래와 같은 식으로 추출할 수 있다.For example, the certificate authority's implicit certificate associated with the sender's implicit certificate is L -1, and the recipient has the last public key (CA _L )

If you know), you can extract the sender's public key like this:

Equation 2:

-좌표인 r및 메시지의 해시값인H(m)에 서명자의 개인키를 사용하여 생성하는 서명쌍 (r, s)를 사용할 수 있고, 서명 검증 과정에서는 임시점(R)을 재구성함에 따라 재구성점(R')를 획득하고, 재구성점(R')의

-좌표와 r을 비교하여 서명의 유효성을 검증할 수 있다. In performing the digital signature verification, a batch signature verification method is generally applied to shorten the time for verifying a plurality of signatures received from the sender. For batch signature verification, a modified ECDSA can generally be used. The default ECDSA is a set of temporary points (R) created during signature generation.

You can use signature pairs (r, s) that are generated by using the signer's private key for the coordinate r and the hash value H (m) of the message, and reconstruct the temporary point R during the signature verification process. point (R ') obtaining and reconstruction point (R' a)

The signature can be validated by comparing the coordinates with r.

-좌표를 r, 발신자의 공개키를

라고 할 때, 메시지의 전자 서명은 임시점(R)과

를 비교함으로써 검증될 수 있다.In the modified ECDSA, instead of the signature pair (r, s), the signature pair of (R, s) can be used to directly compare the reconstruction point ( R ' ) and the temporary point (R). More specifically, the hash value H (m) of the message received from the sender, the base point of the elliptic curve, the digital signature of the message (R, s), the temporary point (R) of

-The coordinate r, the sender's public key

, The digital signature of the message is a temporary point (R)

Can be verified by comparing

에 공개키 추출식인 수학식 2를 대입하여 서명을 검증한다. 이러한 서명 검증 식은 수학식 3과 같이 나타낼 수 있다. In this signature verification system, the sender's public key used for the signature verification expression.

The signature is verified by substituting Equation 2, which is a public key extraction formula into. This signature verification expression may be represented as in Equation 3.

Equation 3:

When using the above method, the number of addition operations of the points is the same but can be saved by sharing the double operation of the points used in the conventional public key extraction process with the signature verification process.

(

는 난수(randomizer))와

, 다시 말해서, In batch signature verification, multiple digital signatures

(

Is a randomizer

, In other words,

를 비교함으로써 보다 빠른 서명 검증이 가능하게 된다.

Fast signature verification is possible by comparing

와

, 다시 말해서,

Applying the present invention to the batch signature verification method

Wow

, In other words,

를 비교하여 다수의 서명을 검증할 수 있다.

You can compare and verify multiple signatures.

또는 인증 기관의 공개키에 해당하는 점의 상수배 연산들을 하나로 병합하여 연산량을 줄일 수 있다.Reconstruction information extracted from the shared implicit certificate when sharing the certificate of the same certificate authority as shown in FIG. 3 in performing the batch signature verification

Alternatively, the amount of computation can be reduced by merging the constant multiple operations of points corresponding to the public key of the certification authority into one.

와

, 다시 말해서,For example, suppose there are two senders U ₁ and U ₂ . Caller U _1, when the share certificates and the implicit one explicit certificate of the certification authority of the L-1 of the certificate authority attached to their certificate as shown in FIG. 3 U ₂ a, U ₁ and U ₂ is the signature of

Wow

, In other words,

를 비교하여 검증할 수 있다.

Can be verified by comparing

부터

까지의 내재적 인증서들로부터 추출되는 재구성 정보인

그리고

의 공개키인

에 대한 점의 상수배 연산이 두 개씩 존재하기 때문에 하나의 점의 상수배 연산으로 병합할 수 있다. 이에 따라 상기 식을 At this time, the certification authority

from

Reconstruction information extracted from implicit certificates up to

And

Public key of

Since there are two constant multiple operations of points on, we can merge them into a constant multiple operation of a single point. Accordingly

으로 나타낼 수 있다.

It can be represented as

개의 점의 상수배 연산에서

개의 점의 상수배 연산으로 줄어들게 된다.Using the above method to merge constant multiple operations on the same point, the computation cost of verifying the signature of

In a constant multiple of two points

This is reduced by a constant multiplication of the two points.

According to one embodiment, the signature verification system makes it possible to verify the signature of a normal sender. Since the same reconstruction information of the inherent certificate as in the existing signature verification process is used, the same result as the signature verification result of the existing sender can be obtained.

According to an embodiment, the signature verification system may shorten the digital signature verification time by applying both the basic digital signature verification and the batch signature verification method in the protocol using the existing implicit certificate.

In addition, the signature verification system can be applied with the sliding window and Straus algorithm to efficiently derive the constant multiple of multiple points on the elliptic curve in the calculation process for signature verification.

4 is a block diagram illustrating a configuration of a signature verification system according to an embodiment, and FIG. 5 is a flowchart illustrating a signature verification process in a signature verification system according to an embodiment.

The signature verification system 400 may include a receiver 410, an extractor 420, and a performer 430. The signature verification system 400 and the components of the signature verification system 400 may control the signature verification system to perform the steps 510 to 530 included in the entire process of signature verification of FIG. 5. In this case, the signature verification system 400 and the components of the signature verification system 400 may be implemented to execute instructions according to code of an operating system included in a memory and code of at least one program. Here, the components of the signature verification system 400 may be representations of different functions performed by the signature verification system 400 in accordance with control instructions provided by the program code stored in the signature verification system 400. Can be.

In operation 510, the receiver 410 may receive an electronic certificate based on a message with an electronic signature transmitted from the sender.

In operation 520, the extractor 420 may extract reconfiguration information for extracting the sender's public key from the intrinsic certificate as the intrinsic certificate is used as the electronic certificate. The extractor 420 may extract the hash value of the implicit certificate and the public key reconstruction information encoded in the implicit certificate, and use the hash value and the reconstruction information and the public key of the certificate authority that issued the implicit certificate for signature verification. If the extractor 420 fails to identify the public key of the certificate authority, the extracting unit 420 encodes a hash value of the certificate authority's implicit certificate and the public certificate encoded from the implicit certificate of the certificate authority. Key reconstruction information can be extracted.

In operation 530, the execution unit 430 may perform signature verification on the electronic signature using the reconstruction information extracted by the extraction unit 420 from the implicit certificate and the hash value of the implicit certificate. In the signature verification for the electronic signature, the execution unit 430 may apply a batch signature verification method to shorten the time for verifying signatures when a plurality of signatures are input. The modified ECDSA can be applied as a signature algorithm for batch signature verification.

-좌표, 전자 서명이 부가될 메시지의 해시값 및 발신자의 개인키를 이용하여 생성된 제1 서명쌍(r, s)을 사용하여 임시점을 재구성함에 따라 획득된 재구성점의

-좌표를 비교할 수 있다. 또는 수행부(430)는 제1 서명쌍 대신 상기 임시점이 포함된 제2 서명쌍(R, s)을 사용하여 재구성점과 임시점을 비교할 수 있다.Execution unit 430 of the temporary point obtained by generating the electronic signature

The reconstruction point obtained by reconstructing the temporary point using the first signature pair (r, s) generated using the coordinates, the hash value of the message to which the digital signature is attached, and the sender's private key.

Coordinates can be compared. Alternatively, the execution unit 430 may compare the reconstruction point and the temporary point by using the second signature pair R and s including the temporary point instead of the first signature pair.

또는 인증 기관의 공개키에 해당하는 점의 상수배 연산들을 하나로 병합하여 계산할 수 있다. 다시 말해서, 수행부(430)는 복수의 발신자에게서 전자 인증서를 수신함에 따라 각각의 전자 인증서와 연결된 동일한 인증 기관들을 공유하는 경우, 재구성 정보를 추출하는 과정에서 추출된 이전의 발신자의 공개키를 재구성하기 위해 사용된 재구성 정보들 중 동일한 재구성 정보들을 가산할 수 있다. In addition, when the performing unit 430 receives the electronic certificates from a plurality of senders and shares the same certificate authorities associated with each electronic signature, reconstruction information extracted from the shared intrinsic certificate in performing the batch signature verification is performed.

Alternatively, the constant multiple operations of points corresponding to the public key of the certification authority may be merged into one. In other words, the execution unit 430 reconstructs the public key of the previous sender extracted in the process of extracting the reconfiguration information when sharing the same certificate authority associated with each electronic certificate as the electronic certificate is received from a plurality of senders. The same reconstruction information may be added among the reconstruction information used for the purpose.

In this case, a sliding window and a Straus algorithm may be applied to efficiently derive a constant multiple of a plurality of points on an elliptic curve in the process of verifying a signature.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the devices and components described in the embodiments are, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors, microcomputers, field programmable gate arrays (FPGAs). Can be implemented using one or more general purpose or special purpose computers, such as a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of explanation, one processing device may be described as being used, but one of ordinary skill in the art will appreciate that the processing device includes a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as parallel processors.

The software may include a computer program, code, instructions, or a combination of one or more of the above, and configure the processing device to operate as desired, or process it independently or collectively. You can command the device. Software and / or data may be any type of machine, component, physical device, virtual equipment, computer storage medium or device in order to be interpreted by or to provide instructions or data to the processing device. It can be embodied in. The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. Software and data may be stored on one or more computer readable recording media.

The method according to the embodiment may be embodied in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the media may be those specially designed and constructed for the purposes of the embodiments, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

Although the embodiments have been described by the limited embodiments and the drawings as described above, various modifications and variations are possible to those skilled in the art from the above description. For example, the described techniques may be performed in a different order than the described method, and / or components of the described systems, structures, devices, circuits, etc. may be combined or combined in a different form than the described method, or other components. Or even if replaced or substituted by equivalents, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are within the scope of the claims that follow.

Claims (7)

In the signature verification method,
Receiving an electronic certificate based on a message with an electronic signature sent from the sender;
Extracting reconfiguration information used to reconstruct the sender's public key from the implicit certificate as an implicit certificate is used as the electronic certificate; And
Performing signature verification on the electronic signature using the reconstruction information extracted from the implicit certificate
Including,
Extracting reconfiguration information used to reconstruct the sender's public key from the implicit certificate,
Extract the hash value of the implicit certificate and the public key reconstruction information encoded in the implicit certificate, extract the hash value and the public key of the certificate authority that issued the implicit certificate, and extract the public key of the certificate authority. If not identified, extracting the hash value and public key reconstruction information of the intrinsic certificate for the certification authority issued from the certification authority higher than the certification authority and the public key of the higher certification authority that issued the certification authority's certificate. step
Signature verification method comprising a. delete delete The method of claim 1,
The step of performing signature verification on the electronic signature using the reconstruction information extracted from the implicit certificate,
Applying a batch signature verification method to reduce the time to verify signatures upon receipt of electronic signatures from a plurality of senders
Signature verification method comprising a. The method of claim 1,
The step of performing signature verification on the electronic signature using the reconstruction information extracted from the implicit certificate,
Among the reconfiguration information used for reconstructing the public key of the previous sender extracted in the process of extracting the reconfiguration information when sharing the same certificate authorities associated with each digital signature as the electronic signature is received from a plurality of senders. Adding the same reconstruction information
Signature verification method comprising a. In the signature verification method,
Receiving an electronic certificate based on a message with an electronic signature sent from the sender;
Extracting reconfiguration information used to reconstruct the sender's public key from the implicit certificate as an implicit certificate is used as the electronic certificate; And
Performing signature verification on the electronic signature using the reconstruction information extracted from the implicit certificate
Including,
The step of performing signature verification on the electronic signature using the reconstruction information extracted from the implicit certificate,
Of the temporary point obtained by generating the electronic signature

A reconstruction point obtained by reconstructing the temporary point using a coordinate, a hash value of the message to which the digital signature is to be attached, and a first signature pair generated using the sender's private key.

Comparing coordinates or comparing the reconstruction point and the temporary point using a second signature pair that includes the temporary point instead of the first signature pair.
Signature verification method comprising a. In the signature verification system,
A receiving unit which receives the electronic certificate based on the message with the electronic signature transmitted from the sender;
An extraction unit for extracting reconfiguration information used for reconstructing the sender's public key from the intrinsic certificate as the intrinsic certificate is used as the electronic certificate; And
An execution unit that performs signature verification on the electronic signature using the reconstruction information extracted from the implicit certificate.
Including,
The extraction unit,
Extract the hash value of the implicit certificate and the public key reconstruction information encoded in the implicit certificate, extract the hash value and the public key of the certificate authority that issued the implicit certificate, and extract the public key of the certificate authority. If not identified, extracting the hash value and public key reconstruction information of the intrinsic certificate for the certification authority issued from the certification authority higher than the certification authority and the public key of the higher certification authority that issued the certification authority's certificate.
Signature Verification System.

Images